2 Commits

Include renames

Author	SHA1	Message	Date
thePR0M3TH3ANandClaude Fable 5	841d0984b3	TS port slice 8: profiles, config, and the session agent ... - Python-compatible ~/.seedpass layout: fingerprints.json (same shape, indent=4), per-profile dirs with parent_seed.enc (kdf/ct wrapper; unlock honors argon2id metadata and falls back across pbkdf2 iteration counts), index-key-encrypted seedpass_config.json.enc with ConfigManager defaults. - CLI: fingerprint list/add/switch/remove (remove requires --yes), config get/set (JSON-parsed values, pin/password hashes redacted on read), profile-aware vault resolution (--vault override, else active profile). - Session agent (the chosen unlock model): unix-socket daemon holding unlocked seeds in memory with TTL, 0600 socket; agent start/status/stop, vault unlock (password -> parent seed -> agent, never argv) and vault lock. Seed resolution order: SEEDPASS_MNEMONIC env, then agent. This daemon is the designed enforcement point for the section-9.3 lease/token layer. - Tests cover the full no-env-mnemonic lifecycle: locked error -> unlock with password only -> provision/reveal through the agent -> status -> lock -> locked again. 148 core + 29 CLI tests green. Co-Authored-By: Claude Fable 5 <[email protected]>	2026-08-14 14:15:51 -04:00
thePR0M3TH3ANandClaude Fable 5	ab569fe900	TS port slice 4: portable backup, CI, and the agent-blind CLI MVP ... - Portable backup (format_version 1): TS imports Python exports, re-exports byte-identically under pinned nonce/timestamp, verifies the canonical checksum, rejects tampering and unknown versions. - .github/workflows/ts-parity.yml: typecheck + Node/jsdom parity suite on js/ changes, plus a fixture-drift job that regenerates fixtures from Python and fails if the committed ones don't match (manifest commit field excluded by construction). - packages/cli — seedpass-js MVP implementing plan section 9.3: * reference-first output: entry list/get/search emit sp://entry/<id> refs and metadata; secret-bearing fields become has_* flags * 'entry reveal' is the only plaintext egress command * 'use --clipboard|--exec|--stdin-to' delivers secrets to sinks; --exec injects SEEDPASS_SECRET into the child env, never argv or stdout * vault export/import over portable backups; capabilities --format json * mnemonic comes from SEEDPASS_MNEMONIC env, never the command line - CLI tests prove the blindness properties: derived password matches the v2 fixture, TOTP at pinned time, secrets absent from all default output and from sink-delivery confirmations. - 125 core parity tests (Node + jsdom) + 11 CLI tests green. Co-Authored-By: Claude Fable 5 <[email protected]>	2026-08-13 10:40:56 -04:00