[doctatortot]

Summary

Closes #52. A utilities plugin that generates secrets in three modes:

• Password — configurable length (6–64) and character-set toggles (lower/upper/digits/symbols), with an option to exclude visually ambiguous characters (0/O, 1/l/I).
• Passphrase — word-based, drawn from a curated 1424-word list (no profanity, no easily-confused homophones, 3–8 letters each), configurable word count (3–8), separator, capitalization, and an optional trailing number.
• API Key — base62 token with an optional prefix (e.g. sk_live_...).

All three modes share an entropy-based strength meter, and the Copy button supports a configurable clipboard auto-clear timeout (Never/15s/30s/60s) — it only clears the clipboard if it still holds exactly what this plugin copied, so it won't clobber something else you copied in the meantime.

All randomness goes through crypto.getRandomValues via rejection sampling, never Math.random, since the whole point of this plugin is producing secrets.

A bug this testing caught

My first version of the rejection-sampling helper only drew a single random byte (0–255), which works fine for small character sets but infinite-loops for any pool larger than 256 — exactly the 1424-word wordlist used by Passphrase mode. Running the generator logic directly (outside the UI) against a real assertion suite caught this before it shipped: switching to Passphrase mode would have hung. Fixed by sampling a 32-bit value instead, and re-verified with 20,000 draws confirming uniform coverage across all 1424 words (no modulo bias).

Permissions

• clipboard.write — copy the generated secret
• clipboard.read — check the clipboard still holds our value before auto-clearing it

Test plan

• npx tsc --noEmit — clean
• npm run build — builds to dist/index.js (34.90 kB) via the standard IIFE template config
• Ran generator.ts's functions directly (transpiled, outside the plugin sandbox) against real assertions: password length/charset/ambiguous-char exclusion over 200 samples, passphrase word-membership/format over 50 samples, API key prefix/no-prefix formatting, strength ordering, and a 20,000-draw distribution check on the wordlist
• Not yet exercised inside the actual Hermes IDE UI — I don't have a way to drive that app's GUI from this environment, so the panel's rendering/interactions are unverified beyond tsc's type checking

🤖 Generated with Claude Code