basic-password-manager 0.4.4__tar.gz → 0.4.6__tar.gz

{basic_password_manager-0.4.4 → basic_password_manager-0.4.6}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: basic-password-manager
-Version: 0.4.4
+Version: 0.4.6
 Summary: The Paladin — a local encrypted password manager that lives in your terminal
 License-Expression: MIT
 Project-URL: Repository, https://github.com/Daisentaur/password-manager
@@ -102,6 +102,7 @@ Same vault, no interface, for when you just want the thing:
 | `paladin gen -l 32` | just print a random password |
 | `paladin import passwords.csv` | import a browser CSV export (see below) |
 | `paladin mobile` | open your vault on your phone (QR + HTTPS tunnel) |
+| `paladin mobile -b` | same, but keeps running after you close the terminal |
 | `paladin about` | meet the knight |
 
 The vault lives at `~/.local/share/pw-manager/vault`. Point the `PW_VAULT`
@@ -154,11 +155,25 @@ use (reverse proxy, named tunnel — `PALADIN_MOBILE_PORT` changes the port).
 From then on plain `paladin mobile` serves at your subdomain, every time, so
 a phone bookmark keeps working.
 
-To be clear about what this does and doesn't change: a session still only
-lives while `paladin mobile` is running — closing it still ends access, and
-the secret path at the end of the URL still expires every 30 days (your
-bookmark needs refreshing then, on purpose). The only difference is that
-every new session opens at *your* address instead of a random one.
+Every new session opens at *your* address instead of a random one, and the
+secret path at the end of the URL still expires every 30 days (your bookmark
+needs refreshing then, on purpose).
+
+### Keeping it up after you close the terminal
+
+By default a session ends when you press Ctrl+C — fine for a quick lookup,
+useless if you want the bookmark to work while you're out. So:
+
+```bash
+paladin mobile -b          # background: survives closing the terminal
+paladin mobile --status    # what's running, and when the link expires
+paladin mobile --stop      # end it now
+```
+
+A background session keeps serving until you stop it or the link hits its
+30-day expiry, at which point it shuts itself down rather than lingering
+forever. What's exposed the whole time is the same encrypted blob as always
+— useless without the master password — behind a random 128-bit path.
 
 The one thing crossing the internet is the encrypted blob, which is useless
 without the master password that never leaves your phone. The tunnel provider

{basic_password_manager-0.4.4 → basic_password_manager-0.4.6}/README.md

@@ -86,6 +86,7 @@ Same vault, no interface, for when you just want the thing:
 | `paladin gen -l 32` | just print a random password |
 | `paladin import passwords.csv` | import a browser CSV export (see below) |
 | `paladin mobile` | open your vault on your phone (QR + HTTPS tunnel) |
+| `paladin mobile -b` | same, but keeps running after you close the terminal |
 | `paladin about` | meet the knight |
 
 The vault lives at `~/.local/share/pw-manager/vault`. Point the `PW_VAULT`
@@ -138,11 +139,25 @@ use (reverse proxy, named tunnel — `PALADIN_MOBILE_PORT` changes the port).
 From then on plain `paladin mobile` serves at your subdomain, every time, so
 a phone bookmark keeps working.
 
-To be clear about what this does and doesn't change: a session still only
-lives while `paladin mobile` is running — closing it still ends access, and
-the secret path at the end of the URL still expires every 30 days (your
-bookmark needs refreshing then, on purpose). The only difference is that
-every new session opens at *your* address instead of a random one.
+Every new session opens at *your* address instead of a random one, and the
+secret path at the end of the URL still expires every 30 days (your bookmark
+needs refreshing then, on purpose).
+
+### Keeping it up after you close the terminal
+
+By default a session ends when you press Ctrl+C — fine for a quick lookup,
+useless if you want the bookmark to work while you're out. So:
+
+```bash
+paladin mobile -b          # background: survives closing the terminal
+paladin mobile --status    # what's running, and when the link expires
+paladin mobile --stop      # end it now
+```
+
+A background session keeps serving until you stop it or the link hits its
+30-day expiry, at which point it shuts itself down rather than lingering
+forever. What's exposed the whole time is the same encrypted blob as always
+— useless without the master password — behind a random 128-bit path.
 
 The one thing crossing the internet is the encrypted blob, which is useless
 without the master password that never leaves your phone. The tunnel provider

{basic_password_manager-0.4.4 → basic_password_manager-0.4.6}/basic_password_manager.egg-info/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: basic-password-manager
-Version: 0.4.4
+Version: 0.4.6
 Summary: The Paladin — a local encrypted password manager that lives in your terminal
 License-Expression: MIT
 Project-URL: Repository, https://github.com/Daisentaur/password-manager
@@ -102,6 +102,7 @@ Same vault, no interface, for when you just want the thing:
 | `paladin gen -l 32` | just print a random password |
 | `paladin import passwords.csv` | import a browser CSV export (see below) |
 | `paladin mobile` | open your vault on your phone (QR + HTTPS tunnel) |
+| `paladin mobile -b` | same, but keeps running after you close the terminal |
 | `paladin about` | meet the knight |
 
 The vault lives at `~/.local/share/pw-manager/vault`. Point the `PW_VAULT`
@@ -154,11 +155,25 @@ use (reverse proxy, named tunnel — `PALADIN_MOBILE_PORT` changes the port).
 From then on plain `paladin mobile` serves at your subdomain, every time, so
 a phone bookmark keeps working.
 
-To be clear about what this does and doesn't change: a session still only
-lives while `paladin mobile` is running — closing it still ends access, and
-the secret path at the end of the URL still expires every 30 days (your
-bookmark needs refreshing then, on purpose). The only difference is that
-every new session opens at *your* address instead of a random one.
+Every new session opens at *your* address instead of a random one, and the
+secret path at the end of the URL still expires every 30 days (your bookmark
+needs refreshing then, on purpose).
+
+### Keeping it up after you close the terminal
+
+By default a session ends when you press Ctrl+C — fine for a quick lookup,
+useless if you want the bookmark to work while you're out. So:
+
+```bash
+paladin mobile -b          # background: survives closing the terminal
+paladin mobile --status    # what's running, and when the link expires
+paladin mobile --stop      # end it now
+```
+
+A background session keeps serving until you stop it or the link hits its
+30-day expiry, at which point it shuts itself down rather than lingering
+forever. What's exposed the whole time is the same encrypted blob as always
+— useless without the master password — behind a random 128-bit path.
 
 The one thing crossing the internet is the encrypted blob, which is useless
 without the master password that never leaves your phone. The tunnel provider

{basic_password_manager-0.4.4 → basic_password_manager-0.4.6}/pw_manager/cli.py

@@ -64,9 +64,28 @@ def cmd_init(args):
 
 
 def cmd_mobile(args):
+    import time
+
     from . import mobile
 
     try:
+        if args.stop:
+            print("background session stopped" if mobile.stop_daemon() else "nothing running")
+            return
+        if args.status:
+            state = mobile.read_state()
+            if not state:
+                print("no background session running")
+                return
+            left = (state["expires"] - time.time()) / 86400
+            print(f"serving {state['url']}\nlink expires in {left:.1f} days (pid {state['pid']})")
+            return
+        if args.background:
+            url = mobile.start_daemon(VAULT_PATH, stable_url=args.url)
+            mobile.print_qr(url)
+            print("  running in the background — it survives closing this terminal.")
+            print("  'paladin mobile --status' to check, '--stop' to end it.\n")
+            return
         mobile.run(VAULT_PATH, stable_url=args.url)
     except mobile.MobileError as e:
         sys.exit(str(e))
@@ -237,6 +256,12 @@ def main():
     i.add_argument("csv_file")
     m = sub.add_parser("mobile", help="open your vault on your phone over an HTTPS tunnel")
     m.add_argument("--url", help="serve at your own https subdomain instead of a quick tunnel")
+    m.add_argument(
+        "-b", "--background", action="store_true",
+        help="keep serving after this terminal closes (until the link expires)",
+    )
+    m.add_argument("--status", action="store_true", help="is a background session running?")
+    m.add_argument("--stop", action="store_true", help="stop the background session")
     sub.add_parser("about", help="meet the knight")
 
     args = p.parse_args()

{basic_password_manager-0.4.4 → basic_password_manager-0.4.6}/pw_manager/logo.py

@@ -75,9 +75,18 @@ def _tinted(pixel, tint, accent):
     return tuple(int(c * lum) for c in base)
 
 
-def _hex_rgb(color: str) -> tuple:
+def _hex_rgb(color: str | None) -> tuple | None:
+    """Parse #rrggbb to (r,g,b). Returns None for anything that isn't hex —
+    ANSI themes use names like 'ansi_blue', and those just mean 'no tint'."""
+    if not color:
+        return None
     color = color.lstrip("#")
-    return tuple(int(color[i : i + 2], 16) for i in (0, 2, 4))
+    if len(color) != 6:
+        return None
+    try:
+        return tuple(int(color[i : i + 2], 16) for i in (0, 2, 4))
+    except ValueError:
+        return None
 
 
 def rich_text(tint: str | None = None, accent: str | None = None) -> Text:

{basic_password_manager-0.4.4 → basic_password_manager-0.4.6}/pw_manager/mobile.py

@@ -9,11 +9,13 @@ and the network only ever carry ciphertext.
 import base64
 import hashlib
 import http.server
+import json
 import os
 import platform
 import re
 import secrets
 import shutil
+import signal
 import stat
 import subprocess
 import sys
@@ -113,6 +115,81 @@ def _load_token() -> str:
     return token
 
 
+def token_expires_at() -> float:
+    """Unix time when the current link stops working."""
+    try:
+        created, _ = open(os.path.join(_data_dir(), "mobile-token")).read().split(":", 1)
+        return float(created) + TOKEN_TTL
+    except (OSError, ValueError):
+        return time.time() + TOKEN_TTL
+
+
+def _state_path() -> str:
+    return os.path.join(_data_dir(), "mobile-session.json")
+
+
+def read_state() -> dict | None:
+    """The running background session, or None if there isn't a live one."""
+    try:
+        with open(_state_path()) as f:
+            state = json.load(f)
+        os.kill(state["pid"], 0)  # raises if that process is gone
+        return state
+    except (OSError, ValueError, KeyError):
+        return None
+
+
+def stop_daemon() -> bool:
+    """Stop a background session. True if one was running."""
+    state = read_state()
+    if not state:
+        return False
+    try:
+        os.kill(state["pid"], signal.SIGTERM)
+    except OSError:
+        pass
+    try:
+        os.remove(_state_path())
+    except OSError:
+        pass
+    return True
+
+
+def start_daemon(vault_path: str, stable_url: str | None = None, port: int = 0) -> str:
+    """Re-launch ourselves detached so the session outlives this shell.
+    Returns the URL the background session is serving."""
+    if read_state():
+        raise MobileError("a background session is already running — 'paladin mobile --stop' first")
+    if not os.path.exists(vault_path):
+        raise MobileError(f"no vault at {vault_path} — run 'paladin init' first")
+
+    log = os.path.join(_data_dir(), "mobile.log")
+    cmd = [sys.executable, "-m", "pw_manager.cli", "mobile"]
+    if stable_url:
+        cmd += ["--url", stable_url]
+    env = {**os.environ, "PALADIN_MOBILE_DAEMON_CHILD": "1"}
+    with open(log, "ab") as logfile:
+        proc = subprocess.Popen(
+            cmd,
+            stdout=logfile,
+            stderr=logfile,
+            stdin=subprocess.DEVNULL,
+            start_new_session=True,  # survives this shell closing
+            env=env,
+        )
+    # wait for the child to publish its URL (tunnel start can take seconds)
+    deadline = time.time() + 45
+    while time.time() < deadline:
+        state = read_state()
+        if state and state.get("pid") == proc.pid:
+            return state["url"]
+        if proc.poll() is not None:
+            raise MobileError(f"background session failed to start — see {log}")
+        time.sleep(0.3)
+    proc.terminate()
+    raise MobileError(f"background session didn't come up in time — see {log}")
+
+
 def _theme_colors() -> dict:
     """Resolve the theme saved by the TUI to a full color palette. The page
     is baked with whatever theme is current when the QR is generated."""
@@ -130,6 +207,10 @@ def _theme_colors() -> dict:
         registry = {t.name: t for t in TUXEDO_THEMES}
         registry.update(BUILTIN_THEMES)
         cs = registry[name].to_color_system().generate()
+        # ANSI themes resolve to names like 'ansi_blue', not hex — the browser
+        # can't use those and the knight can't tint from them, so fall back
+        if not str(cs.get("background", "")).startswith("#"):
+            return default
         return {**default, **cs}
     except (OSError, KeyError, ImportError):
         return default
@@ -247,13 +328,7 @@ def stop_session(server, proc) -> None:
         pass
 
 
-def run(vault_path: str, stable_url: str | None = None, port: int = 0) -> None:
-    def fetched():
-        print(f"  vault page served to a device at {time.strftime('%H:%M:%S')}")
-
-    print("\n  creating your secure link…", flush=True)
-    server, proc, url = start_session(vault_path, stable_url, port, on_fetch=fetched)
-
+def print_qr(url: str) -> None:
     import qrcode
 
     qr = qrcode.QRCode(border=1)
@@ -261,13 +336,45 @@ def run(vault_path: str, stable_url: str | None = None, port: int = 0) -> None:
     print("\n  scan with your phone camera:\n")
     qr.print_ascii(invert=True)
     print(f"\n  {url}\n")
-    print("  the master password is typed on your phone; only ciphertext leaves this machine.")
-    print("  every page load is logged below — Ctrl+C to stop the session.\n")
+
+
+def run(vault_path: str, stable_url: str | None = None, port: int = 0) -> None:
+    is_child = os.environ.get("PALADIN_MOBILE_DAEMON_CHILD") == "1"
+
+    def fetched():
+        print(f"  vault page served to a device at {time.strftime('%H:%M:%S')}", flush=True)
+
+    print("\n  creating your secure link…", flush=True)
+    server, proc, url = start_session(vault_path, stable_url, port, on_fetch=fetched)
+
+    if proc is None:  # stable mode: serving your own address, no quick tunnel
+        print(
+            f"  serving your configured address on 127.0.0.1:{server.server_address[1]}"
+            " — your tunnel/proxy must forward to this port"
+        )
+    else:
+        print("  using a temporary tunnel (set PALADIN_MOBILE_URL for your own subdomain)")
+
+    expires = token_expires_at()
+    if is_child:  # background session: publish state so --status/--stop can find us
+        with open(_state_path(), "w") as f:
+            json.dump({"pid": os.getpid(), "url": url, "expires": expires}, f)
+        signal.signal(signal.SIGTERM, lambda *a: (_ for _ in ()).throw(KeyboardInterrupt))
+    else:
+        print_qr(url)
+        print("  the master password is typed on your phone; only ciphertext leaves this machine.")
+        print("  every page load is logged below — Ctrl+C to stop the session.\n")
 
     try:
-        while True:
+        while time.time() < expires:  # the link's 30 days, enforced for real
             time.sleep(1)
+        print("\nlink expired after 30 days — run 'paladin mobile' again for a fresh one.")
     except KeyboardInterrupt:
         print("\nsession ended.")
     finally:
         stop_session(server, proc)
+        if is_child:
+            try:
+                os.remove(_state_path())
+            except OSError:
+                pass

{basic_password_manager-0.4.4 → basic_password_manager-0.4.6}/pw_manager/tui.py

@@ -11,7 +11,7 @@ import time
 
 from rich.style import Style
 from rich.text import Text
-from textual.app import App, ComposeResult
+from textual.app import App, ComposeResult, SystemCommand
 from textual.binding import Binding
 from textual.command import DiscoveryHit, Hit, Hits, Provider
 from textual.containers import Vertical
@@ -103,6 +103,8 @@ class UnlockScreen(Screen):
             self.query_one("#master", Input).clear()
             return
         self.app.master = event.value
+        # stop repainting the (now-hidden) unlock knight on every theme change
+        self.app.theme_changed_signal.unsubscribe(self)
         self.app.push_screen(MainScreen())
 
 
@@ -167,7 +169,8 @@ def _qr_text(url: str, primary: str) -> tuple[Text, int]:
     must give the widget exactly that width: a wrapped QR is a dead QR."""
     import qrcode
 
-    r, g, b = logo._hex_rgb(primary)
+    rgb = logo._hex_rgb(primary) or (0, 0, 0)  # ansi themes → plain black QR
+    r, g, b = rgb
     while (r + g + b) / 765 > 0.45:
         r, g, b = int(r * 0.8), int(g * 0.8), int(b * 0.8)
     dark, light = f"rgb({r},{g},{b})", "rgb(255,255,255)"
@@ -473,7 +476,7 @@ class MainScreen(Screen):
         self.app.push_screen(ConfirmModal(f"delete '{name}'?"), done)
 
     def action_theme(self) -> None:
-        self.app.push_screen(ThemeModal())
+        self.app._theme()  # same picker the palette opens
 
     def action_search(self) -> None:
         self.query_one("#search", Input).focus()
@@ -609,6 +612,18 @@ class PwApp(App):
         with open(THEME_FILE, "w") as f:
             f.write(theme.name)
 
+    def get_system_commands(self, screen: Screen):
+        """Swap Textual's built-in 'Theme' entry for our picker, so the
+        palette and the `t` key open the same thing."""
+        for command in super().get_system_commands(screen):
+            if command.title == "Theme":
+                yield SystemCommand("Theme", "Change the current theme", self._theme)
+            else:
+                yield command
+
+    def _theme(self) -> None:
+        self.push_screen(ThemeModal())
+
     def _import_csv(self) -> None:
         def done(path: str | None) -> None:
             if not path:

{basic_password_manager-0.4.4 → basic_password_manager-0.4.6}/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "setuptools.build_meta"
 
 [project]
 name = "basic-password-manager"
-version = "0.4.4"
+version = "0.4.6"
 description = "The Paladin — a local encrypted password manager that lives in your terminal"
 readme = "README.md"
 license = "MIT"