keyshroud 0.5.2 → 0.6.0

package/src/cli.ts

@@ -4,13 +4,14 @@ import { constants, homedir } from "node:os";
 import { fileURLToPath } from "node:url";
 import { basename, dirname, join, relative, resolve } from "node:path";
 import { spawn } from "node:child_process";
+import { randomBytes } from "node:crypto";
 import process from "node:process";
 import { BRAND } from "./brand.ts";
 import * as core from "./core.ts";
 import { runClaudeHook } from "./hooks.ts";
 import { serveMcp } from "./mcp.ts";
 import { buildRedactIndex, compileRedactIndex, createRedactor, createRedactStream, type RedactIndex } from "./redact.ts";
-import { ENV_NAME_RE, isRef, looksSecret, parseDotenvStrict, parseRef, type DotenvEntry } from "./refs.ts";
+import { ENV_NAME_RE, isLoaderEnvName, isRef, itemNameProblem, looksSecret, parseDotenvStrict, parseRef, type DotenvEntry } from "./refs.ts";
 
 const usage = `Usage: ${BRAND.bin} <command> [options]
 
@@ -31,6 +32,11 @@ Secrets
   unwire --env NAME [--target pi|omp|both]
 
 Vault
+  setup --email EMAIL [--server URL] [--confirm-unlock] [--registered]
+                                   Give ${BRAND.name} its own bw login on a dedicated agent account
+  migrate [--item NAME]... [--env-file F]... [--yes]
+                                   Copy the wired items from your personal vault to that account
+                                   (dry run unless --yes; prints names only)
   status | unlock | lock | doctor
 
 Agents
@@ -56,17 +62,20 @@ function targetList(value: string | undefined): string[] {
   if (value === "pi") return [targetPaths.pi];
   fail("--target must be omp, pi, or both", 2);
 }
-// Terminal: masked prompt. No terminal (an agent's shell) and no --stdin: a native
-// dialog, so the agent can start the command and the user only pastes.
-async function readSecret(args: string[], prompt: string, label: string, itemName: string): Promise<string> {
-  const forced = args.includes("--dialog");
-  if (forced || (!args.includes("--stdin") && !process.stdin.isTTY)) {
-    const value = await core.readSecretFromDialog({ label, itemName });
-    if (value) return value;
-    if (value === "") throw new Error("Empty secret");
-    if (forced) fail("No dialog available here (SSH or no display). Run the command in a terminal, or pipe the value with --stdin.", 2);
-  }
-  return core.readSecretFromInput({ prompt, stdin: args.includes("--stdin") });
+// --stdin: piped value. Terminal: masked prompt. Otherwise (an agent's shell):
+// a native dialog, so the agent can start the command and the user only pastes.
+async function readSecret(args: string[], prompt: string, itemName: string, envName?: string): Promise<string> {
+  if (args.includes("--stdin")) return core.readSecretFromInput({ prompt, stdin: true });
+  if (process.stdin.isTTY && !args.includes("--dialog")) return core.readSecretFromInput({ prompt, stdin: false });
+  const value = await core.readSecretFromDialog({ itemName, envName });
+  if (value) return value;
+  if (value === "") throw new Error("Empty secret");
+  fail("No terminal and no dialog here (SSH or no display). Run the command in a terminal, or pipe the value with --stdin.", 2);
+}
+function checkNames(envName: string, itemName: string): void {
+  if (isLoaderEnvName(envName)) fail(`${envName} changes what programs load or run; it cannot be wired to a secret`, 2);
+  const problem = itemNameProblem(itemName);
+  if (problem) fail(`Vault item name ${problem}`, 2);
 }
 function shellQuote(value: string): string { return `'${value.replaceAll("'", "'\\''")}'`; }
 function failureCode(error: unknown): number {
@@ -143,9 +152,13 @@ async function inject(args: string[]): Promise<void> {
   await core.audit("inject", refs, output ?? "stdout");
   const rendered = template.replace(pattern, (_match, raw: string) => values.get(raw) ?? "");
   if (!output) { process.stdout.write(rendered); return; }
-  try { await readFile(output); if (!args.includes("--force")) fail(`Refusing to overwrite ${output}; use --force`, 5); } catch {}
-  await writeFile(output, rendered, { mode: 0o600 });
-  await chmod(output, 0o600);
+  // lstat, and a private temp file renamed over the target, so a planted
+  // symlink (even a dangling one) is replaced instead of followed.
+  const exists = await lstat(output).then(() => true, () => false);
+  if (exists && !args.includes("--force")) fail(`Refusing to overwrite ${output}; use --force`, 5);
+  const tmp = join(dirname(resolve(output)), `.${basename(output)}.tmp.${randomBytes(6).toString("hex")}`);
+  await writeFile(tmp, rendered, { mode: 0o600, flag: "wx" });
+  await rename(tmp, output);
   console.error(`rendered ${refs.length} reference(s) into ${output} (mode 0600)`);
 }
 
@@ -188,6 +201,103 @@ async function scan(paths: string[]): Promise<void> {
 
 interface ImportRow { entry: DotenvEntry; kind: "new" | "reuse" | "conflict" | "literal" | "ref"; item?: string; note?: string }
 
+// setup: keyshroud gets its own bw login (CONFIG_DIR/bw) on a separate agent
+// account, so agents never get a session for the user's personal vault.
+async function setupCommand(args: string[]): Promise<void> {
+  requireKnownFlags(args, ["--email", "--server"], ["--confirm-unlock", "--registered"]);
+  const email = valueAfter(args, "--email");
+  if (!email || !/^[^\s@]+@[^\s@]+$/.test(email)) fail("setup needs --email for a separate agent account (not your personal one)", 2);
+  let server = valueAfter(args, "--server");
+  if (!server) { try { server = (JSON.parse(await core.bw(["status"])) as { serverUrl?: string }).serverUrl ?? undefined; } catch {} }
+  if (!server || !/^https:\/\//.test(server)) fail("setup needs --server https://… (no bw server is configured)", 2);
+  const confirm = args.includes("--confirm-unlock");
+  if (confirm && process.platform !== "darwin") fail("--confirm-unlock needs the macOS keychain; Linux secret-tool cannot ask before each read", 2);
+  core.useOwnBwLogin();
+  await mkdir(core.OWN_BW_DIR, { recursive: true, mode: 0o700 });
+  const status = JSON.parse(await core.bw(["status"]).catch(() => "{}")) as { status?: string; userEmail?: string };
+  if (status.userEmail && status.userEmail.toLowerCase() !== email.toLowerCase()) fail(`${BRAND.name}'s bw login already belongs to ${status.userEmail}; remove ${core.OWN_BW_DIR} to start over`, 5);
+  const loggedOut = !status.status || status.status === "unauthenticated";
+  if (loggedOut) await core.bw(["config", "server", server]);
+  await unlink(core.SESSION_FILE).catch(() => {});
+  console.log(`${BRAND.name} now keeps its own bw login in ${core.OWN_BW_DIR}; your personal bw login is untouched.`);
+  const signupUrl = `${server.replace(/\/$/, "")}/#/signup?email=${encodeURIComponent(email)}`;
+  if (!process.stdin.isTTY) {
+    // An agent's shell: nothing can be typed, so keyshroud picks the password.
+    const hasEntry = Boolean(await core.readKeychain(core.KEYCHAIN_MASTER_SERVICE));
+    if (!loggedOut && (confirm || !hasEntry)) fail(`The agent account is already logged in; run \`${BRAND.bin} setup\` in a terminal to store its password`, 2);
+    if (loggedOut && !args.includes("--registered")) {
+      if (!hasEntry && !(await core.generateKeychainSecret(core.KEYCHAIN_MASTER_SERVICE, `${BRAND.name} agent account`, confirm))) fail("Could not store a generated password (needs macOS security or Linux secret-tool)", 3);
+      const master = await core.readKeychain(core.KEYCHAIN_MASTER_SERVICE);
+      if (!master || !(await core.copyToClipboard(master))) fail(`No clipboard tool; run \`${BRAND.bin} setup\` in a terminal instead`, 3);
+      spawn(process.platform === "darwin" ? "open" : "xdg-open", [signupUrl], { stdio: "ignore" }).on("error", () => {});
+      console.log(`A random master password for ${email} is in the keychain (${core.KEYCHAIN_MASTER_SERVICE}) and on the clipboard.`);
+      console.log(`Create the account at ${signupUrl} and paste it into both password fields.`);
+      console.log(`Then: ${BRAND.bin} setup --email ${email} --registered`);
+      return;
+    }
+  }
+  if (loggedOut && !args.includes("--registered")) {
+    const url = signupUrl;
+    console.log(`1. Create the agent account ${email}: ${url}`);
+    console.log("   Pick a new master password, not your personal one.");
+    spawn(process.platform === "darwin" ? "open" : "xdg-open", [url], { stdio: "ignore" }).on("error", () => {});
+    process.stdout.write("   Press Enter once the account exists. ");
+    await new Promise((resolve) => process.stdin.once("data", resolve)); process.stdin.pause();
+  }
+  if (confirm || !(await core.readKeychain(core.KEYCHAIN_MASTER_SERVICE))) {
+    console.log(`2. Type the agent account's master password for the keychain entry ${core.KEYCHAIN_MASTER_SERVICE}${confirm ? " (macOS will ask before every unlock)" : ""}:`);
+    if (!(await core.storeKeychainInteractive(core.KEYCHAIN_MASTER_SERVICE, `${BRAND.name} agent account`, confirm))) fail("Could not store it (needs macOS security or Linux secret-tool)", 3);
+  }
+  const master = await core.readKeychain(core.KEYCHAIN_MASTER_SERVICE);
+  if (!master) fail(`The keychain entry ${core.KEYCHAIN_MASTER_SERVICE} is missing or access was denied`, 3);
+  if (loggedOut) await core.loginOwnAccount(email, master); else await core.ensureSession();
+  await core.clearClipboardIf(master);
+  await core.audit("setup", [], "cli");
+  console.log(`ready: bw login=${email} (own). Next: \`${BRAND.bin} migrate\` copies the wired secrets from your personal vault.`);
+}
+
+// migrate: copy the items that wired names (and env files) reference from the
+// personal vault into the agent account. Same names, so references keep working.
+async function migrateCommand(args: string[]): Promise<void> {
+  requireKnownFlags(args, ["--item", "--env-file"], ["--yes"]);
+  if (!core.OWN_BW_LOGIN) fail(`Run \`${BRAND.bin} setup\` first: migrate copies items into ${BRAND.name}'s own agent account`, 2);
+  const entries = [...await core.authEnvEntries()];
+  for (const file of valuesAfter(args, "--env-file")) entries.push(...await core.envFileEntries(file));
+  const names = new Map<string, string>();
+  for (const entry of entries) { try { const ref = parseRef(entry.raw); if (ref) names.set(ref.item.toLowerCase(), ref.item); } catch {} }
+  for (const name of valuesAfter(args, "--item")) names.set(name.toLowerCase(), name);
+  await core.ensureSession();
+  const own = await core.findItems("");
+  const personal = await core.readPersonalItems();
+  type Row = { name: string; state: "copy" | "present" | "missing" | "ambiguous"; item?: Record<string, unknown> };
+  const rows: Row[] = [...names.values()].sort().map((name) => {
+    if (own.some((item) => item.name.toLowerCase() === name.toLowerCase() || item.id === name)) return { name, state: "present" };
+    const matches = personal.filter((item) => String(item.name ?? "").toLowerCase() === name.toLowerCase() || item.id === name);
+    return matches.length === 1 ? { name, state: "copy", item: matches[0] } : { name, state: matches.length ? "ambiguous" : "missing" };
+  });
+  const width = Math.max(4, ...rows.map((row) => row.name.length));
+  console.log("migrate plan (personal vault -> agent account):");
+  for (const row of rows) console.log(`  ${row.name.padEnd(width)}  ${row.state === "present" ? "already in the agent account" : row.state}`);
+  const count = (state: Row["state"]) => rows.filter((row) => row.state === state).length;
+  console.log(`${count("copy")} to copy, ${count("present")} already there, ${count("missing")} missing, ${count("ambiguous")} ambiguous`);
+  if (!args.includes("--yes")) { console.log("Dry run: nothing copied. Re-run with --yes."); return; }
+  const copied: string[] = [];
+  for (const row of rows.filter((entry) => entry.state === "copy")) {
+    try { await core.copyItemToOwnVault(row.item!); copied.push(row.name); }
+    catch { if (copied.length) console.error(`Copied before the failure: ${copied.join(", ")}`); fail(`Failed to copy ${row.name}`, 3); }
+  }
+  await core.syncOwnVault();
+  const after = await core.findItems("");
+  const unverified = copied.filter((name) => !after.some((item) => item.name.toLowerCase() === name.toLowerCase()));
+  await core.audit("migrate", copied, "cli");
+  await core.refreshRedactIndex();
+  console.log(`copied ${copied.length} item(s) into the agent account; references are unchanged.`);
+  const cut = process.platform === "darwin" ? `security delete-generic-password -s ${core.PERSONAL_KEYCHAIN_MASTER_SERVICE}` : `secret-tool clear service ${core.PERSONAL_KEYCHAIN_MASTER_SERVICE} account "$USER"`;
+  console.log(`Your personal master password is still in the keychain, where any program running as you can read it. Once you no longer need it there: ${cut}`);
+  if (unverified.length) fail(`Not found after copying: ${unverified.join(", ")}`, 4);
+  if (count("missing") || count("ambiguous")) process.exitCode = 4;
+}
+
 async function importCommand(args: string[]): Promise<void> {
   requireKnownFlags(args, ["--from", "--out", "--prefix", "--only", "--skip"], ["--yes", "--replace", "--force"]);
   const from = valueAfter(args, "--from") ?? ".env";
@@ -261,9 +371,9 @@ async function importCommand(args: string[]): Promise<void> {
   const eol = text.includes("\r\n") ? "\r\n" : "\n";
   const lines = text.split(/\r?\n/);
   for (const row of toStore) lines[row.entry.line - 1] = `${row.entry.exported ? "export " : ""}${row.entry.name}=bw://${row.item}`;
-  const mode = replace ? (await stat(out)).mode & 0o777 : 0o644;
-  const tmp = `${out}.tmp.${process.pid}`;
-  await writeFile(tmp, lines.join(eol), { mode });
+  const mode = replace ? (await stat(out)).mode & 0o777 : 0o600;
+  const tmp = `${out}.tmp.${randomBytes(6).toString("hex")}`;
+  await writeFile(tmp, lines.join(eol), { mode, flag: "wx" });
   await rename(tmp, out);
   await core.audit("import", toStore.map((row) => row.entry.name), "cli");
   console.log(`imported ${toStore.length} secret(s) (${created.length} new); wrote ${out}`);
@@ -328,29 +438,37 @@ async function main(): Promise<void> {
       requireKnownFlags(args, ["--env", "--item", "--notes", "--target"], ["--stdin", "--dialog"]);
       const envName = valueAfter(args, "--env"); const itemName = valueAfter(args, "--item"); const notes = valueAfter(args, "--notes");
       if (!envName || !itemName || !ENV_NAME_RE.test(envName)) fail(usage, 2);
+      checkNames(envName, itemName);
       const reference = core.referenceFor(itemName);
       const targets = targetList(valueAfter(args, "--target"));
       await core.ensureSession();
-      const secret = await readSecret(args, `Paste secret for ${envName}: `, envName, itemName);
+      if ((await core.findItems(itemName)).some((item) => item.name.toLowerCase() === itemName.toLowerCase())) fail(`Vault item already exists: ${itemName}`, 5);
+      const secret = await readSecret(args, `Paste secret for ${envName}: `, itemName, envName);
       await core.createSecretItem({ itemName, secret, envName, notes });
+      await core.audit("add", [envName], "cli");
       let conflict = false;
       for (const path of targets) { const result = await core.writeAuthEntry(path, envName, reference); if (!result.ok) conflict = true; }
       const verified = (await core.resolveShellValue(reference)) !== null;
+      await core.refreshRedactIndex();
       console.log(`created item=${itemName} env=${envName} targets=${targets.join(",")} verified=${verified ? "yes" : "no"}`);
       if (conflict) { console.error("Item created, but one or more auth targets already contained the environment name."); process.exitCode = 5; }
       return;
     }
     if (command === "import") { await importCommand(args); return; }
+    if (command === "setup") { await setupCommand(args); return; }
+    if (command === "migrate") { await migrateCommand(args); return; }
     if (command === "rotate") {
       requireKnownFlags(args, ["--item"], ["--stdin", "--dialog"]);
       const itemName = valueAfter(args, "--item"); if (!itemName) fail(usage, 2);
-      await core.ensureSession(); const secret = await readSecret(args, "Paste replacement secret: ", `the new value of ${itemName}`, itemName);
-      await core.rotateSecretItem({ itemName, secret }); console.log(`rotated item=${itemName}`); return;
+      await core.ensureSession(); const secret = await readSecret(args, "Paste replacement secret: ", itemName);
+      await core.rotateSecretItem({ itemName, secret }); await core.audit("rotate", [itemName], "cli"); await core.refreshRedactIndex();
+      console.log(`rotated item=${itemName}`); return;
     }
     if (command === "wire") {
       requireKnownFlags(args, ["--env", "--item", "--target"], ["--force"]);
       const envName = valueAfter(args, "--env"); const itemName = valueAfter(args, "--item");
       if (!envName || !itemName || !ENV_NAME_RE.test(envName)) fail(usage, 2);
+      if (isLoaderEnvName(envName)) fail(`${envName} changes what programs load or run; it cannot be wired to a secret`, 2);
       const reference = core.referenceFor(itemName);
       const targets = targetList(valueAfter(args, "--target"));
       for (const path of targets) { const result = await core.writeAuthEntry(path, envName, reference, { overwrite: args.includes("--force") }); if (!result.ok) fail(result.message, 5); }
@@ -388,7 +506,7 @@ async function main(): Promise<void> {
     if (command === "doctor") {
       requireKnownFlags(args, []);
       try { await core.ensureSession(); } catch {}
-      const s = await core.getStatus(); console.log(`bw version=${s.version ?? "missing (install @bitwarden/cli)"}`); console.log(`bw server=${s.serverUrl ?? "unconfigured (run: bw config server <url>)"}`); console.log(`session=${s.status}`);
+      const s = await core.getStatus(); console.log(`bw login=${core.OWN_BW_LOGIN ? `own agent account (${core.OWN_BW_DIR})` : `shared with your personal bw (run: ${BRAND.bin} setup)`}`); console.log(`bw version=${s.version ?? "missing (install @bitwarden/cli)"}`); console.log(`bw server=${s.serverUrl ?? "unconfigured (run: bw config server <url>)"}`); console.log(`session=${s.status}`);
       for (const [service, present] of Object.entries(await core.keychainPresence())) console.log(`keychain ${service}=${present ? "present" : "missing"}`);
       for (const path of [targetPaths.omp, targetPaths.pi]) for (const name of Object.keys(await core.readAuthEntries(path))) console.log(`${path} ${name} resolved=${(await authValue(name)) ? "yes" : "no"}`);
       console.log(`redact index=${(await core.readRedactIndex()) ? "present" : "missing"}`);

package/src/core.ts

@@ -1,13 +1,15 @@
 // Runtime-neutral core: no pi/omp/Claude Code imports. Every caller (agent
 // extensions, CLI, MCP server, hooks) goes through these functions.
-import { execFile } from "node:child_process";
+import { execFile, spawn } from "node:child_process";
+import { randomBytes } from "node:crypto";
+import { existsSync } from "node:fs";
 import { appendFile, chmod, mkdir, readFile, realpath, rename, rm, stat, unlink, writeFile } from "node:fs/promises";
 import { homedir } from "node:os";
 import { join, dirname } from "node:path";
 import process from "node:process";
 import { BRAND } from "./brand.ts";
 import { buildRedactIndex, type RedactIndex } from "./redact.ts";
-import { ENV_NAME_RE, legacyRefFor, parseEnvFile, parseRef, type SecretRef } from "./refs.ts";
+import { ENV_NAME_RE, isLoaderEnvName, itemNameProblem, legacyRefFor, parseEnvFile, parseRef, type SecretRef } from "./refs.ts";
 
 const P = BRAND.envPrefix;
 function setting(name: string): string | undefined {
@@ -20,9 +22,25 @@ export const SESSION_FILE = join(CONFIG_DIR, "session");
 export const MASTER_PASSWORD_FILE = join(CONFIG_DIR, "master-password");
 export const REDACT_INDEX_FILE = join(CONFIG_DIR, "redact-index.json");
 export const AUDIT_FILE = join(CONFIG_DIR, "audit.jsonl");
-export const KEYCHAIN_MASTER_SERVICE = setting("KEYCHAIN_MASTER") ?? "vaultwarden-master-password";
-export const KEYCHAIN_CLIENT_ID_SERVICE = setting("KEYCHAIN_CLIENT_ID") ?? "vaultwarden-api-client-id";
-export const KEYCHAIN_CLIENT_SECRET_SERVICE = setting("KEYCHAIN_CLIENT_SECRET") ?? "vaultwarden-api-client-secret";
+
+// After `setup`, keyshroud keeps its own bw login (a dedicated agent account) in
+// CONFIG_DIR/bw, with its own keychain entries, so the user's personal bw login
+// and vault are never unlocked. Without it, keyshroud shares the default bw login.
+export const OWN_BW_DIR = join(CONFIG_DIR, "bw");
+export const PERSONAL_KEYCHAIN_MASTER_SERVICE = setting("PERSONAL_KEYCHAIN_MASTER") ?? "vaultwarden-master-password";
+export let OWN_BW_LOGIN = false;
+export let KEYCHAIN_MASTER_SERVICE = setting("KEYCHAIN_MASTER") ?? PERSONAL_KEYCHAIN_MASTER_SERVICE;
+export let KEYCHAIN_CLIENT_ID_SERVICE = setting("KEYCHAIN_CLIENT_ID") ?? "vaultwarden-api-client-id";
+export let KEYCHAIN_CLIENT_SECRET_SERVICE = setting("KEYCHAIN_CLIENT_SECRET") ?? "vaultwarden-api-client-secret";
+
+export function useOwnBwLogin(): void {
+  OWN_BW_LOGIN = true;
+  process.env.BITWARDENCLI_APPDATA_DIR = OWN_BW_DIR;
+  KEYCHAIN_MASTER_SERVICE = setting("KEYCHAIN_MASTER") ?? `${BRAND.bin}-master-password`;
+  KEYCHAIN_CLIENT_ID_SERVICE = setting("KEYCHAIN_CLIENT_ID") ?? `${BRAND.bin}-api-client-id`;
+  KEYCHAIN_CLIENT_SECRET_SERVICE = setting("KEYCHAIN_CLIENT_SECRET") ?? `${BRAND.bin}-api-client-secret`;
+}
+if (!process.env.BITWARDENCLI_APPDATA_DIR && existsSync(join(OWN_BW_DIR, "data.json"))) useOwnBwLogin();
 
 export const PROVIDER_KEYS: ReadonlySet<string> = new Set([
   "anthropic", "openai", "azure-openai-responses", "deepseek", "google", "mistral",
@@ -66,12 +84,13 @@ export const referenceFor = legacyRefFor;
 
 // Vault credentials never reach commands run on the agent's behalf: with the
 // session token a child could dump the whole vault, defeating `--only`.
-export const VAULT_ENV_KEYS: readonly string[] = ["BW_SESSION", "BW_PASSWORD", "BW_CLIENTID", "BW_CLIENTSECRET"];
+export const VAULT_ENV_KEYS: readonly string[] = ["BW_SESSION", "BW_PASSWORD", "BW_CLIENTID", "BW_CLIENTSECRET", "BITWARDENCLI_APPDATA_DIR"];
 
 export function childEnv(extra: Record<string, string> = {}): Record<string, string> {
   const env: Record<string, string> = {};
   for (const [name, value] of Object.entries(process.env)) if (value !== undefined && !VAULT_ENV_KEYS.includes(name)) env[name] = value;
-  return { ...env, ...extra };
+  for (const [name, value] of Object.entries(extra)) if (!isLoaderEnvName(name)) env[name] = value;
+  return env;
 }
 
 export async function bw(args: string[], opts: { input?: string; session?: string } = {}): Promise<string> {
@@ -203,10 +222,12 @@ export async function resolveRef(ref: SecretRef): Promise<string | null> {
   }
 }
 
-async function readKeychain(service: string): Promise<string | null> {
+// The timeout leaves room for a macOS "allow access" prompt when the entry was
+// stored with `setup --confirm-unlock`; a missing entry still fails at once.
+export async function readKeychain(service: string): Promise<string | null> {
   const user = process.env.USER || process.env.LOGNAME || "";
   try {
-    const result = await runFile("security", ["find-generic-password", "-a", user, "-s", service, "-w"], { timeout: 10000, maxBuffer: 1024 * 1024 });
+    const result = await runFile("security", ["find-generic-password", "-a", user, "-s", service, "-w"], { timeout: 120000, maxBuffer: 1024 * 1024 });
     return result.stdout.trim() || null;
   } catch {}
   try {
@@ -251,8 +272,8 @@ export function ensureSession(): Promise<string> {
 
 async function writePrivateFile(path: string, content: string): Promise<void> {
   await mkdir(dirname(path), { recursive: true, mode: 0o700 });
-  const tmp = `${path}.tmp.${process.pid}`;
-  await writeFile(tmp, content, { encoding: "utf8", mode: 0o600 });
+  const tmp = `${path}.tmp.${randomBytes(6).toString("hex")}`;
+  await writeFile(tmp, content, { encoding: "utf8", mode: 0o600, flag: "wx" });
   await chmod(tmp, 0o600);
   await rename(tmp, path);
   await chmod(path, 0o600);
@@ -292,6 +313,114 @@ async function ensureSessionInner(existing: string | undefined): Promise<string>
   return token;
 }
 
+// Store a keychain entry by letting the OS tool prompt for the value on the
+// user's terminal, so keyshroud never holds it in argv. `confirm` (macOS) trusts
+// no app, so every later read asks the user first.
+export async function storeKeychainInteractive(service: string, label: string, confirm: boolean): Promise<boolean> {
+  const user = process.env.USER || process.env.LOGNAME || "";
+  const attempts: Array<[string, string[]]> = process.platform === "darwin"
+    ? [["security", ["add-generic-password", "-U", "-a", user, "-s", service, "-l", label, ...(confirm ? ["-T", ""] : []), "-w"]]]
+    : [["secret-tool", ["store", `--label=${label}`, "service", service, "account", user]]];
+  // -U keeps an existing entry's access list, so an ask-every-time entry is recreated.
+  if (process.platform === "darwin" && confirm) await runFile("security", ["delete-generic-password", "-a", user, "-s", service], { timeout: 10000, maxBuffer: 1024 * 1024 }).catch(() => {});
+  for (const [command, args] of attempts) {
+    const code = await new Promise<number | null>((resolve) => {
+      const child = spawn(command, args, { stdio: "inherit" });
+      child.on("error", () => resolve(null));
+      child.on("exit", (exit) => resolve(exit));
+    });
+    if (code === 0) return true;
+  }
+  return false;
+}
+
+// `setup` from an agent's shell (no terminal): a random master password for the
+// new agent account, written to the keychain over stdin. Nobody types it and it
+// never reaches argv or output; the user gets it via the clipboard for signup.
+export async function generateKeychainSecret(service: string, label: string, confirm: boolean): Promise<boolean> {
+  const secret = randomBytes(24).toString("base64url");
+  const user = process.env.USER || process.env.LOGNAME || "";
+  const opts = { timeout: 30000, maxBuffer: 1024 * 1024 };
+  try {
+    if (process.platform === "darwin") {
+      // `security -i` reads the command from stdin, so the value is not in argv.
+      await runFile("security", ["-i"], opts, `add-generic-password -U -a "${user}" -s "${service}" -l "${label}"${confirm ? ' -T ""' : ""} -w "${secret}"\n`);
+      await runFile("security", ["find-generic-password", "-a", user, "-s", service], opts);
+    } else {
+      await runFile("secret-tool", ["store", `--label=${label}`, "service", service, "account", user], opts, secret);
+    }
+    return true;
+  } catch { return false; }
+}
+
+const CLIPBOARD_TOOLS: Array<[string, string[], string, string[]]> = process.platform === "darwin"
+  ? [["pbcopy", [], "pbpaste", []]]
+  : [["wl-copy", [], "wl-paste", ["--no-newline"]], ["xclip", ["-selection", "clipboard"], "xclip", ["-selection", "clipboard", "-o"]]];
+
+export async function copyToClipboard(text: string): Promise<boolean> {
+  for (const [copy, args] of CLIPBOARD_TOOLS) {
+    try { await runFile(copy, args, { timeout: 10000, maxBuffer: 1024 * 1024 }, text); return true; } catch {}
+  }
+  return false;
+}
+
+// Empty the clipboard only if it still holds `text`.
+export async function clearClipboardIf(text: string): Promise<void> {
+  for (const [copy, copyArgs, paste, pasteArgs] of CLIPBOARD_TOOLS) {
+    try {
+      if ((await runFile(paste, pasteArgs, { timeout: 10000, maxBuffer: 1024 * 1024 })).stdout.trim() === text) await runFile(copy, copyArgs, { timeout: 10000, maxBuffer: 1024 * 1024 }, "");
+      return;
+    } catch {}
+  }
+}
+
+// `setup`: log keyshroud's own bw login in to the agent account. stdin and
+// stderr stay on the terminal so bw can ask for a two-step login code.
+export async function loginOwnAccount(email: string, master: string): Promise<string> {
+  const token = await new Promise<string>((resolve, reject) => {
+    const child = spawn("bw", ["login", email, "--passwordenv", "BW_PASSWORD", "--raw"], { env: { ...process.env, BW_PASSWORD: master }, stdio: ["inherit", "pipe", "inherit"] });
+    let out = "";
+    child.stdout.on("data", (chunk: Buffer) => { out += chunk; });
+    child.on("error", reject);
+    child.on("exit", (exit) => (exit === 0 && out.trim() ? resolve(out.trim()) : reject(new Error("bw login failed"))));
+  });
+  await writePrivateFile(SESSION_FILE, `${token}\n`);
+  process.env.BW_SESSION = token;
+  try { await bw(["sync", "--quiet"], { session: token }); } catch {}
+  invalidateSecretCache();
+  return token;
+}
+
+// `migrate`: read the items of the bw login the user had before setup (the
+// default bw data dir), then lock it again. The values stay in memory.
+export async function readPersonalItems(): Promise<Array<Record<string, unknown>>> {
+  const master = await readKeychain(PERSONAL_KEYCHAIN_MASTER_SERVICE);
+  if (!master) throw new Error(`Personal master password not in the keychain (${PERSONAL_KEYCHAIN_MASTER_SERVICE})`);
+  const env = (extra: Record<string, string>) => {
+    const out: Record<string, string> = {};
+    for (const [name, value] of Object.entries(process.env)) if (value !== undefined && !VAULT_ENV_KEYS.includes(name)) out[name] = value;
+    return { ...out, ...extra };
+  };
+  const token = (await runFile("bw", ["unlock", "--passwordenv", "BW_PASSWORD", "--raw"], { env: env({ BW_PASSWORD: master }), timeout: 30000, maxBuffer: 4 * 1024 * 1024 })).stdout.trim();
+  if (!token) throw new Error("Personal vault unlock returned no session");
+  try {
+    const parsed = JSON.parse((await runFile("bw", ["list", "items"], { env: env({ BW_SESSION: token }), timeout: 120000, maxBuffer: 256 * 1024 * 1024 })).stdout) as unknown;
+    return Array.isArray(parsed) ? parsed as Array<Record<string, unknown>> : [];
+  } finally {
+    try { await runFile("bw", ["lock"], { env: env({}), timeout: 20000, maxBuffer: 1024 * 1024 }); } catch {}
+  }
+}
+
+// A personal item as a new item for the agent account: no ids, folders,
+// organizations, history, attachments or per-item key (encrypted to the personal account).
+export async function copyItemToOwnVault(item: Record<string, unknown>): Promise<void> {
+  const copy: Record<string, unknown> = { ...item, favorite: false };
+  for (const key of ["id", "key", "object", "organizationId", "folderId", "collectionIds", "revisionDate", "creationDate", "deletedDate", "passwordHistory", "attachments"]) delete copy[key];
+  await bw(["create", "item"], { input: Buffer.from(JSON.stringify(copy), "utf8").toString("base64") });
+}
+
+export async function syncOwnVault(): Promise<void> { await bw(["sync", "--quiet"]); invalidateSecretCache(); }
+
 // Forget the cached session and lock the bw CLI. The next resolve unlocks
 // again from the keychain.
 export async function lock(): Promise<void> {
@@ -455,6 +584,7 @@ export async function resolveEntries(entries: Array<{ name: string; raw: string
 export async function envFileEntries(path: string): Promise<Array<{ name: string; raw: string }>> {
   return parseEnvFile(await readFile(path, "utf8")).map(({ name, value }) => {
     if (value.trim().startsWith("!")) throw new Error(`${path}: ${name} uses a shell command; env files accept only bw:// references and literals`);
+    if (isLoaderEnvName(name)) throw new Error(`${path}: ${name} changes what programs load or run; env files cannot set it`);
     return { name, raw: value };
   });
 }
@@ -504,6 +634,12 @@ export async function writeRedactIndex(values: Record<string, string>): Promise<
   return index;
 }
 
+// Re-index after the wired set changes so hooks mask a new value right away.
+export async function refreshRedactIndex(): Promise<void> {
+  const env = await resolveEntries(await authEnvEntries());
+  await writeRedactIndex(indexValues(env.secrets));
+}
+
 export async function readRedactIndex(): Promise<RedactIndex | null> {
   try {
     const parsed = JSON.parse(await readFile(REDACT_INDEX_FILE, "utf8")) as RedactIndex;
@@ -531,7 +667,16 @@ export async function getSecret(itemName: string): Promise<string> {
   try { return await bw(["get", "password", itemName]); } catch (error) { throw mapItemError(error, itemName); }
 }
 
+// An agent can start add/rotate, so a dialog could be used to phish the master
+// password into an item it can then read; refuse it outright.
+async function refuseMasterPassword(secret: string): Promise<void> {
+  if (secret && secret === await readMasterPassword()) throw new Error("Refusing to store the vault master password as a secret");
+}
+
 export async function createSecretItem(opts: { itemName: string; secret: string; envName?: string; notes?: string }): Promise<{ id: string }> {
+  const problem = itemNameProblem(opts.itemName);
+  if (problem) throw new Error(`Vault item name ${problem}`);
+  await refuseMasterPassword(opts.secret);
   const existing = await findItems(opts.itemName);
   if (existing.some((item) => item.name.toLowerCase() === opts.itemName.toLowerCase())) throw new Error(`Vault item already exists: ${opts.itemName}`);
   const item: Record<string, unknown> = {
@@ -548,6 +693,7 @@ export async function createSecretItem(opts: { itemName: string; secret: string;
 }
 
 export async function rotateSecretItem(opts: { itemName: string; secret: string }): Promise<{ id: string }> {
+  await refuseMasterPassword(opts.secret);
   let parsed: Record<string, unknown>;
   try { parsed = JSON.parse(await bw(["get", "item", opts.itemName])) as Record<string, unknown>; } catch (error) { throw mapItemError(error, opts.itemName); }
   const login = parsed.login && typeof parsed.login === "object" ? parsed.login as Record<string, unknown> : {};
@@ -565,45 +711,82 @@ export async function deleteItem(id: string, permanent = false): Promise<void> {
 }
 
 export async function readSecretFromInput(opts: { prompt: string; stdin: boolean }): Promise<string> {
-  if (opts.stdin || !process.stdin.isTTY) {
+  if (opts.stdin) {
     let input = "";
     for await (const chunk of process.stdin) input += String(chunk);
     input = input.replace(/\r?\n$/, "");
     if (!input) throw new Error("Empty secret");
     return input;
   }
+  if (!process.stdin.isTTY) throw new Error("No terminal to prompt on; pipe the value with --stdin");
   const value = await readMasked(opts.prompt);
   if (!value) throw new Error("Empty secret");
   return value;
 }
 
 // Native hidden-input dialog for callers without a terminal (agent shells, MCP).
-// Names reach the dialog through env vars, so an item name cannot inject
-// AppleScript; the value comes back only on the dialog's stdout. Resolves null
-// when no dialog can be shown (SSH, headless Linux, missing tools).
-export async function readSecretFromDialog(opts: { label: string; itemName: string }): Promise<string | null> {
+// An agent can open it, so the wording is fixed, says who asked, and warns
+// against the master password; names are validated and passed as data (argv),
+// never as script. One dialog at a time, with a pause after a cancel. Resolves
+// null when no dialog can be shown (SSH, headless Linux, missing tools).
+const DIALOG_LOCK = join(CONFIG_DIR, "dialog.lock");
+const DIALOG_COOLDOWN_MS = 30_000;
+const DIALOG_TIMEOUT_MS = 300_000;
+
+export async function readSecretFromDialog(opts: { itemName: string; envName?: string }): Promise<string | null> {
   if (process.env.SSH_CONNECTION || process.env.SSH_TTY) return null;
-  const text = `Paste the secret for ${opts.label}\nVault item: ${opts.itemName}`;
+  const problem = itemNameProblem(opts.itemName);
+  if (problem) throw new Error(`Vault item name ${problem}`);
+  if (opts.envName !== undefined && !ENV_NAME_RE.test(opts.envName)) throw new Error("Variable names must be UPPER_SNAKE_CASE");
+  const text = [
+    opts.envName ? "A program on this computer, usually an AI agent, asked to store a NEW secret." : "A program on this computer, usually an AI agent, asked to REPLACE the value of a secret.",
+    "",
+    ...(opts.envName ? [`Variable: ${opts.envName}`] : []),
+    `Vault item: ${opts.itemName}`,
+    "",
+    "This is not a login prompt. Never enter your vault master password here.",
+  ].join("\n");
   const candidates: Array<[string, string[]]> = process.platform === "darwin"
-    ? [["osascript", ["-e", [
-        'set t to "Paste the secret for " & (system attribute "KEYSHROUD_DIALOG_ENV") & return & "Vault item: " & (system attribute "KEYSHROUD_DIALOG_ITEM")',
-        'activate',
-        'text returned of (display dialog t default answer "" with hidden answer with title "keyshroud" buttons {"Cancel", "Save"} default button "Save" cancel button "Cancel")',
-      ].join("\n")]]]
+    ? [["osascript", ["-e", "on run argv", "-e", 'activate', "-e",
+        'text returned of (display dialog (item 1 of argv) default answer "" with hidden answer with title "keyshroud" buttons {"Cancel", "Save"} default button "Save" cancel button "Cancel" with icon caution)',
+        "-e", "end run", "--", text]]]
     : process.env.DISPLAY || process.env.WAYLAND_DISPLAY
-      ? [["zenity", ["--entry", "--hide-text", "--title=keyshroud", `--text=${text}`]], ["kdialog", ["--title", "keyshroud", "--password", text]]]
+      ? [["zenity", ["--entry", "--hide-text", "--no-markup", "--title=keyshroud", `--text=${text}`]], ["kdialog", ["--title", "keyshroud", "--password", text.replace(/[<>]/g, "")]]]
       : [];
-  for (const [command, args] of candidates) {
-    const result = await new Promise<{ code: number | string | null; stdout: string; stderr: string }>((resolve) => {
-      execFile(command, args, { env: { ...process.env, KEYSHROUD_DIALOG_ENV: opts.label, KEYSHROUD_DIALOG_ITEM: opts.itemName }, timeout: 300_000 },
-        (error, stdout, stderr) => resolve({ code: error ? ((error as NodeJS.ErrnoException).code ?? 1) : 0, stdout: String(stdout), stderr: String(stderr) }));
-    });
-    if (result.code === "ENOENT") continue;
-    if (result.code === 0) return result.stdout.replace(/\r?\n$/, "");
-    if (command !== "osascript" || /-128/.test(result.stderr)) throw new Error("Cancelled");
+  if (!candidates.length) return null;
+  return withDialogLock(async () => {
+    for (const [command, args] of candidates) {
+      const result = await new Promise<{ code: number | string | null; stdout: string; stderr: string }>((resolve) => {
+        execFile(command, args, { timeout: DIALOG_TIMEOUT_MS }, (error, stdout, stderr) => resolve({ code: error ? ((error as NodeJS.ErrnoException).code ?? 1) : 0, stdout: String(stdout), stderr: String(stderr) }));
+      });
+      if (result.code === "ENOENT") continue;
+      if (result.code === 0) return result.stdout.replace(/\r?\n$/, "");
+      if (command !== "osascript" || /-128/.test(result.stderr)) throw new Error("Cancelled");
+      return null;
+    }
     return null;
+  });
+}
+
+async function withDialogLock<T>(fn: () => Promise<T>): Promise<T> {
+  await mkdir(CONFIG_DIR, { recursive: true, mode: 0o700 });
+  let held = "";
+  try { held = await readFile(DIALOG_LOCK, "utf8"); } catch {}
+  const [kind, at] = held.trim().split(":");
+  const age = Date.now() - Number(at);
+  const live = (kind === "open" || kind === "cancelled") && age >= 0 && age < (kind === "cancelled" ? DIALOG_COOLDOWN_MS : DIALOG_TIMEOUT_MS + 30_000);
+  if (!live) await rm(DIALOG_LOCK, { force: true });
+  try { await writeFile(DIALOG_LOCK, `open:${Date.now()}\n`, { flag: "wx", mode: 0o600 }); }
+  catch { throw new Error(kind === "cancelled" ? "The last dialog was cancelled; wait 30 seconds before asking again" : "Another keyshroud dialog is already open"); }
+  try {
+    const value = await fn();
+    await rm(DIALOG_LOCK, { force: true });
+    return value;
+  } catch (error) {
+    if (error instanceof Error && error.message === "Cancelled") await writeFile(DIALOG_LOCK, `cancelled:${Date.now()}\n`, { mode: 0o600 });
+    else await rm(DIALOG_LOCK, { force: true });
+    throw error;
   }
-  return null;
 }
 
 // Raw-mode prompt that echoes one "*" per character (capped, then a count), so
@@ -616,14 +799,25 @@ function readMasked(prompt: string): Promise<string> {
     process.stderr.write(`\r\x1b[2K${prompt}${shown}`);
   };
   return new Promise((resolve, reject) => {
+    // After Enter, keep reading briefly: the rest of a multi-line paste must be
+    // consumed here (or it would reach the parent shell) and is then refused.
+    let ending: ReturnType<typeof setTimeout> | undefined;
+    let multiline = false;
+    const settle = () => {
+      clearTimeout(ending);
+      ending = setTimeout(() => finish(multiline ? new Error("Multi-line values are not supported in the prompt; pipe them with --stdin") : undefined), 100);
+    };
     const finish = (error?: Error) => {
+      clearTimeout(ending);
       stdin.off("data", onData); stdin.setRawMode(false); stdin.pause();
       process.stderr.write("\n");
       if (error) reject(error); else resolve(chars.join(""));
     };
     const onData = (chunk: string) => {
-      for (const ch of chunk.replace(/\x1b\[[0-9;?]*[ -/]*[@-~]|\x1b./g, "")) {
-        if (ch === "\r" || ch === "\n") return finish();
+      if (ending) { if (/[^\r\n]/.test(chunk)) multiline = true; return settle(); }
+      const clean = [...chunk.replace(/\x1b\[[0-9;?]*[ -/]*[@-~]|\x1b./g, "")];
+      for (const [index, ch] of clean.entries()) {
+        if (ch === "\r" || ch === "\n") { if (/[^\r\n]/.test(clean.slice(index + 1).join(""))) multiline = true; return settle(); }
         if (ch === "\x03") return finish(new Error("Cancelled"));
         if (ch === "\x04") return chars.length ? finish() : finish(new Error("Cancelled"));
         if (ch === "\x7f" || ch === "\b") chars.pop();