dsh-vault — 加密凭据保险库插件 / Encrypted Credential Vault Plugin

[Ox0400]

中文

dsh-vault 是一个面向 DeepSeek Harness 的加密凭据保险库插件:把你在使用 AI 过程中产生的用户名、邮箱、手机号、密码、TOTP 密钥,以及开发工作流中的 SSH 连接、API Key、Secret、OAuth access/refresh token 等敏感凭据加密存储,并通过模型工具提供增删改查、检索、密码生成与动态验证码能力,还带一个设置页 UI。

安全特性

• 零外部加密依赖:全部基于 Node 内置 node:crypto(AES-256-GCM + scrypt + RFC 6238 TOTP)
• 检索不泄密:vault_search 只返回摘要,绝不返回密码/密钥/令牌
• 三态访问模式:readonly(只读)/ ask(写入前询问,走审批通道)/ auto(自动读写),可在设置页切换
• 自动锁库:空闲超时自动清空内存密钥(lockTimeoutSeconds + vault_lock/vault_unlock)
• 防暴力破解:连续错误密码 5 次后锁定 5 分钟
• 高敏条目:sensitivity: high 的条目在 ask 模式下读取也需确认
• 软删除回收站:vault_delete → vault_restore / vault_purge
• 轮换与健康:vault_rotation(到期/待轮换)、vault_health(弱密码/复用检测)

22 个工具(节选)

vault_add / vault_get / vault_search(多词 OR 检索)/ vault_update / vault_delete / vault_totp / vault_totp_uri / vault_generate_password / vault_strength / vault_fill / vault_env / vault_rekey / vault_import_csv / vault_export / vault_import / vault_switch / vault_list / vault_rotation / vault_health / vault_lock / vault_unlock / vault_templates

安装

dsh plugin --profile demo add dsh-vault              # npm,最省事
dsh plugin --profile demo add github:Ox0400/dsh-vault#v0.5.0   # GitHub

设置主密码环境变量后即可使用:

export DSH_VAULT_PASSWORD='你的强主密码'

用法示例

- id: vault
  name: dsh-vault
  config:
    masterPasswordEnv: DSH_VAULT_PASSWORD
    accessMode: ask        # 或 readonly / auto
    autoCapture: true      # 对话中检测到密钥时提议保存
    lockTimeoutSeconds: 300

把 SSH/API/OAuth 凭据存入保险库后,让模型 vault_search 定位、vault_get 取用;autoCapture: true 时你在对话里分享的 API Key 会在你同意后自动存入。更多用法见 https://github.com/Ox0400/dsh-vault

---

English

dsh-vault is an encrypted credential vault plugin for DeepSeek Harness. It stores usernames, emails, phone numbers, passwords, TOTP secrets, and developer credentials (SSH connections, API keys, secrets, OAuth access/refresh tokens) encrypted at rest, and exposes them through model tools (CRUD, search, password & TOTP generation) plus a Settings UI.

Security highlights

• Zero external crypto deps: everything on Node's built-in node:crypto (AES-256-GCM + scrypt + RFC 6238 TOTP)
• Search never leaks: vault_search returns summaries only — never passwords/keys/tokens
• Three-state access mode: readonly / ask (prompt-before-write via the approval channel) / auto, switchable in the Settings UI
• Auto-lock: idle timeout wipes the in-memory key (lockTimeoutSeconds + vault_lock/vault_unlock)
• Brute-force guard: 5 failed password attempts → 5-minute lockout
• High-sensitivity entries: reading sensitivity: high entries asks for confirmation in ask mode
• Soft delete / trash: vault_delete → vault_restore / vault_purge
• Rotation & health: vault_rotation (expired/due), vault_health (weak/reused credentials)

22 tools (selection)

vault_add / vault_get / vault_search (multi-term OR) / vault_update / vault_delete / vault_totp / vault_totp_uri / vault_generate_password / vault_strength / vault_fill / vault_env / vault_rekey / vault_import_csv / vault_export / vault_import / vault_switch / vault_list / vault_rotation / vault_health / vault_lock / vault_unlock / vault_templates

Install

dsh plugin --profile demo add dsh-vault              # npm, easiest
dsh plugin --profile demo add github:Ox0400/dsh-vault#v0.5.0   # GitHub

Set the master-password env var and go:

export DSH_VAULT_PASSWORD='your strong master password'

Usage example

- id: vault
  name: dsh-vault
  config:
    masterPasswordEnv: DSH_VAULT_PASSWORD
    accessMode: ask        # or readonly / auto
    autoCapture: true      # offer to save credentials shared in chat
    lockTimeoutSeconds: 300

Store SSH/API/OAuth credentials, then let the model vault_search to find and vault_get to use them; with autoCapture: true an API key you share in chat is saved after your consent. More: https://github.com/Ox0400/dsh-vault

[Ox0400]

v0.1.0 — 首个版本 / Initial release

中文:首个可安装版本。AES-256-GCM + scrypt 加密核心、7 个模型工具、设置页 UI(中英双语)、VaultGateway RPC、41 项测试。支持 npm / GitHub / 本地路径 / tarball 四种安装。

English: First installable release. AES-256-GCM + scrypt crypto core, 7 model tools, Settings UI (en/zh), VaultGateway RPC, 41 tests. Installable via npm / GitHub / local path / tarball.

[Ox0400]

v0.2.0 — 访问模式与自动捕获 / Access mode & auto-capture

中文:新增 accessMode(readonly/readwrite)与 autoCapture 系统提示词——开启后模型可检测对话中分享的凭据并在用户同意时用 vault_add 保存;设置页显示模式徽标与空库引导。

English: Added accessMode (readonly/readwrite) and autoCapture system-prompt guidance — the model can detect credentials shared in chat and offer to save them via vault_add; the Settings UI shows the mode badge and an onboarding hint.

[Ox0400]

v0.3.0 — 三态访问模式 / Three-state access mode

中文:accessMode 升级为三态:readonly / ask(写入前询问,写入走 harness 审批通道)/ auto。设置页新增下拉切换并持久化到 access.json,模型工具与 UI 共享同一份实时策略。

English: accessMode is now three-state: readonly / ask (prompt-before-write through the harness approval channel) / auto. The Settings UI gained a switcher persisted to access.json; tools and UI share one live policy.

[Ox0400]

v0.4.0 — 安全与工作流扩展 / Security & workflow expansion

中文:自动锁库(lockTimeoutSeconds + vault_lock/unlock)、防暴力破解(5 次错误锁定 5 分钟)、软删除回收站(vault_restore/purge)、轮换报告(vault_rotation)、健康扫描(vault_health)、整库加密备份(vault_export/import);新增 vault_fill / vault_env / vault_templates;UI 增加健康摘要与回收站视图。

English: Auto-lock (lockTimeoutSeconds + vault_lock/vault_unlock), brute-force guard (5 failures → 5-min lockout), soft delete/trash (vault_restore/vault_purge), rotation report (vault_rotation), health scan (vault_health), encrypted backup (vault_export/vault_import); new vault_fill/vault_env/vault_templates; UI gained health summary and trash view.

[Ox0400]

v0.5.0 — 十轮升级 / Ten rounds of upgrades

中文:vault_rekey(原地 KDF 升级)、vault_import_csv(CSV 批量导入)、vault_strength(密码强度评估)、vault_totp_uri(otpauth URI)、vault_switch/vault_list(多库切换)、审计事件(vault/read + vault/write)、高敏条目读取审批;vault_search 支持多词 OR 检索;UI 增加类型筛选、高敏徽标、密钥遮罩与显示切换。共 22 个工具、67 项测试。

English: vault_rekey (in-place KDF upgrade), vault_import_csv (bulk CSV import), vault_strength (password strength), vault_totp_uri (otpauth URI), vault_switch/vault_list (multi-vault), audit events (vault/read + vault/write), high-sensitivity read approval; vault_search multi-term OR; UI kind filter, HIGH badge, masked secret fields with reveal toggle. 22 tools, 67 tests.

[Ox0400]

v0.5.1 — 设置页新增 autoCapture 开关 / autoCapture toggle in Settings UI

中文:设置页现在同时提供两个开关——访问模式下拉(只读 / 写入前询问 / 自动读写)与自动捕获复选框(对话中出现凭据时模型是否主动提议保存)。切换即时生效并持久化到 access.json。68 项测试。

English: The Settings UI now offers both controls — the access-mode dropdown (readonly / ask / auto) and an auto-capture checkbox (whether the model offers to save credentials it detects in chat). Changes apply immediately and persist to access.json. 68 tests.

[Ox0400]

v0.6.0 — 剪贴板、相关性检索、类型校验、最近使用

中文:新增 vault_clipboard(取回某个密钥字段用于复制,并提醒勿在对话中复述);vault_search 增加相关性排序(标题前缀 > 标题包含 > 任意字段);修复 vault_update 缺少字段类型校验的 bug 并把 sensitivity/rotationDays 加入工具 schema;新增 vault_recent(最近使用,参考 Bitwarden);空库提示补充 CSV 导入引导。24 个工具,71 项测试。

English: New vault_clipboard (fetch a secret field for copy with a do-not-echo caution); vault_search relevance ranking (title prefix > title contains > any-field); fixed missing typed-field validation in vault_update and exposed sensitivity/rotationDays in its schema; new vault_recent (Bitwarden-style); empty-state hint mentions vault_import_csv. 24 tools, 71 tests.

[Electricitysheep]

加密凭据保险库（TOTP/API Key/SSH 凭据加密存储）——这正好补上第 13 章安全基线的"凭据管理"一环，比让模型明文接触密钥安全得多。

已收录进手册生态章节 + 第 13 章安全相关：https://github.com/Electricitysheep/dsh-handbook/blob/main/docs/13-security.md

[Ox0400]

v0.6.1 — 备份、统计、CSV 判重修复

中文:新增 vault_backup(带时间戳的加密库副本)与 vault_stats(概览统计,参考 1Password);修复 vault_import_csv 按 title+kind 判重、并补齐 vault_add/vault_update 的 sensitivity/rotationDays 字段(此前会被静默丢弃);vault_get 输出清理空字段;空库时隐藏回收站按钮。26 个工具,74 项测试。

English: New vault_backup (timestamped copy of the encrypted vault) and vault_stats (1Password-style overview); fixed vault_import_csv to dedupe by title+kind and added sensitivity/rotationDays to the vault_add/vault_update schemas (previously dropped); vault_get strips empty fields; UI hides the trash button on an empty vault. 26 tools, 74 tests.

[Ox0400]

v0.6.2 — CSV 导出、类型筛选、收藏置顶

中文:新增 vault_export_csv(导出为可回导的 CSV,可按 kind 过滤);vault_search 支持 kind 参数;新增 vault_pin/vault_unpin(参考 Bitwarden 收藏——置顶条目在检索中优先并在 UI 显示 ★);修复 vault_totp 对空/过短 Base32 密钥的错误提示。30 个工具,78 项测试。

English: New vault_export_csv (import-shaped CSV, optional kind filter); vault_search gained a kind param; new vault_pin/vault_unpin (Bitwarden-style — pinned entries rank first and show ★ in the UI); fixed vault_totp error messages for empty/too-short Base32 secrets. 30 tools, 78 tests.

[Ox0400]

v0.6.3 — 过期工具、环境变量过滤、可打印报告

中文:新增 vault_expiry(设置/清除条目过期时间,轮换报告即时反映);vault_env 支持 kind 过滤与重复 key 去重(首个条目优先);修复 vault_update patch 漏传 sensitivity/favorite/rotationDays 的 bug;新增 vault_report(不含密钥的可打印清单,参考 1Password);搜索框增加清除按钮。33 个工具,81 项测试。

English: New vault_expiry (set/clear an entry's expiry, reflected in the rotation report); vault_env gained a kind filter + duplicate-key dedupe (first entry wins); fixed vault_update dropping sensitivity/favorite/rotationDays; new vault_report (printable secret-free inventory, 1Password-style); search clear button. 33 tools, 81 tests.

[Ox0400]

v0.6.4 — 活动审计、弱密码警告、自定义字段编辑

中文:新增 vault_changes(窗口内创建/更新/删除的活动审计,默认 24h);vault_add 对弱密码给出警告;修复 vault_unlock 在无法重新派生密钥时的错误提示(主密码可能已变更);编辑表单新增自定义字段编辑(每行 key=value);vault_totp_uri 增加二维码录入提示。34 个工具,84 项测试。

English: New vault_changes (activity audit: created/updated/deleted within a window, default 24h); vault_add warns on weak passwords; fixed vault_unlock's error message when the key can't be re-derived (master password changed); the entry form now edits custom fields (key=value per line); vault_totp_uri returns a QR hint. 34 tools, 84 tests.

[Ox0400]

v0.6.5 — 备注工具、高敏读全程确认、标签统计

中文:新增 vault_notes(追加/替换备注);安全强化:高敏条目的读取现在在 auto 模式也需确认(始终门控,区别于普通写入);修复 vault_import_csv 未校验 kind 的问题(非法行跳过);新增 vault_tags(标签及计数,参考 1Password);列表行增加 hover 高亮。37 个工具,87 项测试。

English: New vault_notes (append/replace notes); security hardening: high-sensitivity reads now require confirmation in auto mode too (always gated); fixed vault_import_csv not validating kind (invalid rows skipped); new vault_tags (tag inventory with counts, 1Password-style); row hover highlight. 37 tools, 87 tests.

[Ox0400]

v0.6.6 — 模糊查找、按类型列出、用户名生成器

中文:新增 vault_find(忽略大小写与标点的模糊查找,"db internal"/"DBINTERNAL"/"db.internal" 均命中);vault_search 的 query 改为可选——可仅按 kind 列出全部;修复空查询此前匹配不到任何条目(现改为列出全部);新增 vault_generate_username(随机用户名/匿名邮箱,参考 1Password);vault_env 值做 shell 转义;UI 增加条目数页脚。39 个工具,91 项测试。

English: New vault_find (fuzzy, case/punctuation-agnostic lookup); vault_search query is now optional — list all filtered by kind; fixed empty-query search matching nothing (now lists all); new vault_generate_username (random username/anonymous email, 1Password-style); vault_env values shell-quoted; UI entry-count footer. 39 tools, 91 tests.

[Ox0400]

v0.6.7 — 校验、TOTP 参数、永久删除保护、类型图标

中文:新增 vault_verify(按类型检查必填字段与完整性,不含密钥);vault_totp 支持显式 period/digits 参数(otpauth URI 声明值优先);vault_purge 增加保护——清除活跃条目必须传 confirm: true,防止误删;UI 条目按类型显示图标。40 个工具,94 项测试。

English: New vault_verify (per-kind completeness check, no secrets); vault_totp gained explicit period/digits params (URI-declared wins); vault_purge now guards ACTIVE entries behind confirm: true; UI shows per-kind icons. 40 tools, 94 tests.

[Ox0400]

v1.9.6 正式版发布 / v1.9.6 stable released

经过 3 个 rc 预览版迭代验证(395 测试全绿), 正式发布 1.9.6。

新增 (New):

• 审计 tab 操作类型过滤(新增/更新/删除/恢复)
• 审计日志标题可点击跳转(跳到条目并自动搜索)

修复/优化 (Fixed/Improved):

• 审计日志改用绝对时间(日期+时间), 便于追溯

New:

• Audit action filter; clickable audit titles that jump to the entry

Fixed/Improved:

• Absolute timestamps in the audit log

测试: 395 通过 (Test: 395 passed) · npm: 1.9.6 (tag latest) · GitHub: v1.9.6

[Ox0400]

v1.9.7-rc.1 — 自动备份 / Auto-backup after writes

新增 (New):

• 写操作后自动备份(1Password 风格)——新增/更新/删除/恢复/清除/置顶后自动创建加密备份
• 保留策略自动轮换, 无需手动备份; 失败不阻断写操作

New:

• Auto-backup after writes (1Password-style) — add/update/delete/restore/purge/pin create an encrypted backup automatically
• Retention auto-prunes; backup failure never blocks the write

测试: 396 通过 (Test: 396 passed) · npm: 1.9.7-rc.1 (tag next) · GitHub: v1.9.7-rc.1

[Ox0400]

v1.9.7 正式版发布 / v1.9.7 stable released

经过 1 个 rc 预览版验证(396 测试全绿), 正式发布 1.9.7。

新增 (New):

• 写操作后自动备份(1Password 风格)——新增/更新/删除/恢复/清除/置顶后自动创建加密备份
• 保留策略自动轮换, 无需手动备份; 失败不阻断写操作

New:

• Auto-backup after writes (1Password-style) with retention auto-pruning; never blocks the write

测试: 396 通过 (Test: 396 passed) · npm: 1.9.7 (tag latest) · GitHub: v1.9.7

[Ox0400]

v1.9.8-rc.1 — 图标映射扩展 / Icon map expansion

新增 (New):

• URL 域名自动图标扩展——新增 40+ 常见站点映射(microsoft/stripe/paypal/binance/openai/vercel 等), 输入 URL 自动填充图标

New:

• Expanded URL-to-icon auto-suggestions with 40+ common sites (microsoft/stripe/paypal/binance/openai/vercel etc.)

npm: 1.9.8-rc.1 (tag next) · GitHub: v1.9.8-rc.1

[Ox0400]

v1.9.8-rc.2 — 测试稳定化 / Test stabilization

修复/优化:

• 备份测试断言稳定化——自动备份异步时序下用 some 断言替代 list[0] 精确匹配, 消除 flaky

Fixed/Improved:

• Stabilized backup-test assertions — use some() instead of exact list[0] matching under async auto-backup timing

测试: 396 通过 (Test: 396 passed) · npm: 1.9.8-rc.2 (tag next) · GitHub: v1.9.8-rc.2

[Ox0400]

v1.9.8 正式版发布 / v1.9.8 stable released

经过 2 个 rc 预览版验证(396 测试全绿), 正式发布 1.9.8。

新增 (New):

• URL 域名自动图标扩展——新增 40+ 常见站点映射(microsoft/stripe/paypal/binance/openai/vercel 等)

修复/优化 (Fixed/Improved):

• 备份测试断言稳定化(消除 flaky)

New:

• Expanded URL-to-icon auto-suggestions (40+ common sites)

Fixed/Improved:

• Stabilized backup-test assertions (removed flake)

测试: 396 通过 (Test: 396 passed) · npm: 1.9.8 (tag latest) · GitHub: v1.9.8

[Ox0400]

v1.9.9-rc.1 — Ctrl+K 快速搜索 / Quick search shortcut

新增 (New):

• Ctrl/Cmd+K 快速搜索快捷键——任意 tab 按下聚焦凭据库搜索框并切回条目页(1Password 风格)

New:

• Ctrl/Cmd+K quick-search shortcut — from any tab, focus the vault search box and switch to Entries (1Password-style)

npm: 1.9.9-rc.1 (tag next) · GitHub: v1.9.9-rc.1

[Ox0400]

v1.9.9-rc.2 — Esc 快捷键 / Esc shortcuts

新增 (New):

• Esc 快捷键——搜索框内 Esc 清除搜索与过滤, 任意位置 Esc 关闭 ⋯ 菜单

New:

• Esc clears the search/filters inside the search box and closes the ⋯ overflow menu anywhere

npm: 1.9.9-rc.2 (tag next) · GitHub: v1.9.9-rc.2

[Ox0400]

v1.9.9 正式版发布 / v1.9.9 stable released

经过 2 个 rc 预览版验证(396 测试全绿), 正式发布 1.9.9。

新增 (New):

• Ctrl/Cmd+K 快速搜索快捷键(1Password 风格)——任意 tab 聚焦搜索框并切回条目页
• Esc 快捷键——清除搜索/过滤, 关闭 ⋯ 菜单

New:

• Ctrl/Cmd+K quick-search shortcut; Esc clears search/filters and closes the ⋯ menu

测试: 396 通过 (Test: 396 passed) · npm: 1.9.9 (tag latest) · GitHub: v1.9.9

[Ox0400]

v1.10.0-rc.1 — 卡输入格式化 / Card input formatting

新增 (New):

• 银行卡输入格式化——卡号自动 4-4-4-4 分组显示, 有效期自动 MM/YY 格式, CVV 仅数字(Kaspersky 风格)

New:

• Card input formatting — card number auto-groups 4-4-4-4, expiry auto-formats MM/YY, CVV digits-only (Kaspersky-style)

npm: 1.10.0-rc.1 (tag next) · GitHub: v1.10.0-rc.1

[Ox0400]

v1.10.0-rc.2 — 卡到期提醒 / Card expiry reminders

新增 (New):

• 银行卡到期提醒——条目列表显示「卡已过期/卡将到期 MM/YY」徽章(到期前 3 个月提示)

New:

• Card expiry reminders — badges on the entry list for expired/expiring cards (within 3 months)

npm: 1.10.0-rc.2 (tag next) · GitHub: v1.10.0-rc.2

[Ox0400]

v1.10.0 正式版发布 / v1.10.0 stable released

经过 2 个 rc 预览版验证(396 测试全绿), 正式发布 1.10.0。

新增 (New):

• 银行卡输入格式化——卡号自动 4-4-4-4 分组, 有效期自动 MM/YY, CVV 仅数字
• 银行卡到期提醒——条目列表显示「卡已过期/卡将到期 MM/YY」徽章(到期前 3 个月)

New:

• Card input formatting (4-4-4-4 grouping, MM/YY expiry, digits-only CVV); card-expiry reminders on the entry list

测试: 396 通过 (Test: 396 passed) · npm: 1.10.0 (tag latest) · GitHub: v1.10.0

[Ox0400]

v1.10.1-rc.1 — 审计日志导出 / Audit log export

新增 (New):

• 审计日志导出 CSV——审计 tab「导出日志」按钮, 按当前过滤导出活动记录(带 BOM Excel 兼容)

New:

• Audit log CSV export — an "Export log" button on the Audit tab exports the filtered activity (with BOM for Excel)

npm: 1.10.1-rc.1 (tag next) · GitHub: v1.10.1-rc.1

[Ox0400]

1.10.2-rc.1 发布 / Released 🚀

新增 / New

• 条目列表内联显示 TOTP 验证码: 有 otpSecret 的条目自动显示当前 6 位验证码 + 30 秒实时倒计时, 行内一键复制。借鉴了 KeePassXC 社区长期请求的 #9247 在条目列表显示 TOTP 列 和 #2568 增加复制 TOTP 按钮。Inline TOTP codes in the entry list with live countdown and one-click copy — inspired by KeePassXC #9247 / [Bug][Windows] dsh web 在 PowerShell 5.1 中 Ctrl+C 退出后控制台失去输入：提示符不出现、打字无回显 #2568.
• 条目摘要新增 hasOtp 标记, TOTP 密钥本身永不下发客户端, 验证码始终在 host 端计算。New hasOtp summary flag; the TOTP secret never leaves the host.

性能考量 / Performance

• 借鉴 KeePassXC 该 issue 被搁置的痛点(每 30s 全量刷新): 我们只对带 OTP 的条目按需拉取, 每批最多 25 条, 已缓存跳过, 仅窗口到期时刷新。Learned from KeePassXC's stalled issue: fetch only OTP rows, batch ≤25, skip cached, refresh only at window expiry.

修复 / Fixes

• 测试 teardown 临时目录 ENOTEMPTY 偶发失败已根除(与异步自动备份写文件竞争), 完整套件 397 测试三轮全绿。Flaky ENOTEMPTY teardown race fixed; 397 tests × 3 runs green.

发布说明: v1.10.2-rc.1, npm: npm i dsh-vault@next

[Ox0400]

1.10.2-rc.2 发布 / Released 🚀

修复 / Fix

• 条目删除 / 批量删除后回收站列表不同步: 删除动作现在同步刷新回收站列表, 切到回收站 tab 立即看到刚删除的条目。这是本轮 Playwright 真实浏览器端到端验证中发现并修复的。After deleting or bulk-deleting entries, the trash tab now syncs immediately — a real bug found during E2E browser verification.

端到端验证 / E2E (17/17 ✅)

• 表单添加含 otpSecret 条目 → 列表内联 TOTP 自动显示 + 倒计时走秒 → 复制验证码写入剪贴板且与显示一致 → 30 秒窗口自动翻码 → 删除后回收站立即可见并可彻底清除 → 850px 窄屏无横向滚动 → 无页面错误。
• Inline TOTP auto-display with live countdown, clipboard copy matches display, 30s rollover, trash sync after delete, narrow-layout OK, zero page errors.

发布说明: v1.10.2-rc.2, npm: npm i dsh-vault@next