basic-password-manager 0.4.5__tar.gz → 0.4.7__tar.gz

{basic_password_manager-0.4.5 → basic_password_manager-0.4.7}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: basic-password-manager
-Version: 0.4.5
+Version: 0.4.7
 Summary: The Paladin — a local encrypted password manager that lives in your terminal
 License-Expression: MIT
 Project-URL: Repository, https://github.com/Daisentaur/password-manager
@@ -102,6 +102,7 @@ Same vault, no interface, for when you just want the thing:
 | `paladin gen -l 32` | just print a random password |
 | `paladin import passwords.csv` | import a browser CSV export (see below) |
 | `paladin mobile` | open your vault on your phone (QR + HTTPS tunnel) |
+| `paladin mobile -b` | same, but keeps running after you close the terminal |
 | `paladin about` | meet the knight |
 
 The vault lives at `~/.local/share/pw-manager/vault`. Point the `PW_VAULT`
@@ -154,11 +155,25 @@ use (reverse proxy, named tunnel — `PALADIN_MOBILE_PORT` changes the port).
 From then on plain `paladin mobile` serves at your subdomain, every time, so
 a phone bookmark keeps working.
 
-To be clear about what this does and doesn't change: a session still only
-lives while `paladin mobile` is running — closing it still ends access, and
-the secret path at the end of the URL still expires every 30 days (your
-bookmark needs refreshing then, on purpose). The only difference is that
-every new session opens at *your* address instead of a random one.
+Every new session opens at *your* address instead of a random one, and the
+secret path at the end of the URL still expires every 30 days (your bookmark
+needs refreshing then, on purpose).
+
+### Keeping it up after you close the terminal
+
+By default a session ends when you press Ctrl+C — fine for a quick lookup,
+useless if you want the bookmark to work while you're out. So:
+
+```bash
+paladin mobile -b          # background: survives closing the terminal
+paladin mobile --status    # what's running, and when the link expires
+paladin mobile --stop      # end it now
+```
+
+A background session keeps serving until you stop it or the link hits its
+30-day expiry, at which point it shuts itself down rather than lingering
+forever. What's exposed the whole time is the same encrypted blob as always
+— useless without the master password — behind a random 128-bit path.
 
 The one thing crossing the internet is the encrypted blob, which is useless
 without the master password that never leaves your phone. The tunnel provider
@@ -211,8 +226,11 @@ Both are thin skins over the two modules above. The TUI (built with
 [Textual](https://textual.textualize.io)) holds the decrypted entries in
 memory for the session; the CLI re-derives the key per command.
 
-Passwords go to the clipboard (`wl-copy`/`xclip`/`xsel`, whichever exists)
-rather than the screen, so they don't sit in your terminal scrollback. One
+Passwords go to the clipboard (`wl-copy`/`xclip`/`xsel`/`pbcopy`/`clip`,
+whichever exists) rather than the screen, so they don't sit in your terminal
+scrollback — and they're wiped from it 45 seconds later by a detached helper
+(the CLI exits immediately, so an in-process timer would never fire). If
+you've copied something else in the meantime, yours is left alone. One
 deliberate asymmetry: CLI `find` does *not* search passwords, because a CLI
 argument lands in your shell history forever — the TUI search box does,
 because nothing you type there is logged anywhere.
@@ -283,8 +301,10 @@ accounts from 2013. `paladin rm <name>` the corpses, or prune the CSV first.
 
 I'd rather you know these than find them:
 
-- No clipboard auto-clear yet: a copied password stays on the clipboard
-  until you copy over it. Copy something else when you're done.
+- The 45-second clipboard window is still a window: anything watching your
+  clipboard in that time sees the password. Set
+  `PALADIN_CLIPBOARD_SECONDS` lower if that bothers you (or `0` to keep the
+  old forever-behaviour).
 - While a command runs, decrypted data briefly exists in process memory.
   Malware already on your machine could read it — true of every password
   manager ever made; the vault protects the file at rest, not a compromised

{basic_password_manager-0.4.5 → basic_password_manager-0.4.7}/README.md

@@ -86,6 +86,7 @@ Same vault, no interface, for when you just want the thing:
 | `paladin gen -l 32` | just print a random password |
 | `paladin import passwords.csv` | import a browser CSV export (see below) |
 | `paladin mobile` | open your vault on your phone (QR + HTTPS tunnel) |
+| `paladin mobile -b` | same, but keeps running after you close the terminal |
 | `paladin about` | meet the knight |
 
 The vault lives at `~/.local/share/pw-manager/vault`. Point the `PW_VAULT`
@@ -138,11 +139,25 @@ use (reverse proxy, named tunnel — `PALADIN_MOBILE_PORT` changes the port).
 From then on plain `paladin mobile` serves at your subdomain, every time, so
 a phone bookmark keeps working.
 
-To be clear about what this does and doesn't change: a session still only
-lives while `paladin mobile` is running — closing it still ends access, and
-the secret path at the end of the URL still expires every 30 days (your
-bookmark needs refreshing then, on purpose). The only difference is that
-every new session opens at *your* address instead of a random one.
+Every new session opens at *your* address instead of a random one, and the
+secret path at the end of the URL still expires every 30 days (your bookmark
+needs refreshing then, on purpose).
+
+### Keeping it up after you close the terminal
+
+By default a session ends when you press Ctrl+C — fine for a quick lookup,
+useless if you want the bookmark to work while you're out. So:
+
+```bash
+paladin mobile -b          # background: survives closing the terminal
+paladin mobile --status    # what's running, and when the link expires
+paladin mobile --stop      # end it now
+```
+
+A background session keeps serving until you stop it or the link hits its
+30-day expiry, at which point it shuts itself down rather than lingering
+forever. What's exposed the whole time is the same encrypted blob as always
+— useless without the master password — behind a random 128-bit path.
 
 The one thing crossing the internet is the encrypted blob, which is useless
 without the master password that never leaves your phone. The tunnel provider
@@ -195,8 +210,11 @@ Both are thin skins over the two modules above. The TUI (built with
 [Textual](https://textual.textualize.io)) holds the decrypted entries in
 memory for the session; the CLI re-derives the key per command.
 
-Passwords go to the clipboard (`wl-copy`/`xclip`/`xsel`, whichever exists)
-rather than the screen, so they don't sit in your terminal scrollback. One
+Passwords go to the clipboard (`wl-copy`/`xclip`/`xsel`/`pbcopy`/`clip`,
+whichever exists) rather than the screen, so they don't sit in your terminal
+scrollback — and they're wiped from it 45 seconds later by a detached helper
+(the CLI exits immediately, so an in-process timer would never fire). If
+you've copied something else in the meantime, yours is left alone. One
 deliberate asymmetry: CLI `find` does *not* search passwords, because a CLI
 argument lands in your shell history forever — the TUI search box does,
 because nothing you type there is logged anywhere.
@@ -267,8 +285,10 @@ accounts from 2013. `paladin rm <name>` the corpses, or prune the CSV first.
 
 I'd rather you know these than find them:
 
-- No clipboard auto-clear yet: a copied password stays on the clipboard
-  until you copy over it. Copy something else when you're done.
+- The 45-second clipboard window is still a window: anything watching your
+  clipboard in that time sees the password. Set
+  `PALADIN_CLIPBOARD_SECONDS` lower if that bothers you (or `0` to keep the
+  old forever-behaviour).
 - While a command runs, decrypted data briefly exists in process memory.
   Malware already on your machine could read it — true of every password
   manager ever made; the vault protects the file at rest, not a compromised

{basic_password_manager-0.4.5 → basic_password_manager-0.4.7}/basic_password_manager.egg-info/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: basic-password-manager
-Version: 0.4.5
+Version: 0.4.7
 Summary: The Paladin — a local encrypted password manager that lives in your terminal
 License-Expression: MIT
 Project-URL: Repository, https://github.com/Daisentaur/password-manager
@@ -102,6 +102,7 @@ Same vault, no interface, for when you just want the thing:
 | `paladin gen -l 32` | just print a random password |
 | `paladin import passwords.csv` | import a browser CSV export (see below) |
 | `paladin mobile` | open your vault on your phone (QR + HTTPS tunnel) |
+| `paladin mobile -b` | same, but keeps running after you close the terminal |
 | `paladin about` | meet the knight |
 
 The vault lives at `~/.local/share/pw-manager/vault`. Point the `PW_VAULT`
@@ -154,11 +155,25 @@ use (reverse proxy, named tunnel — `PALADIN_MOBILE_PORT` changes the port).
 From then on plain `paladin mobile` serves at your subdomain, every time, so
 a phone bookmark keeps working.
 
-To be clear about what this does and doesn't change: a session still only
-lives while `paladin mobile` is running — closing it still ends access, and
-the secret path at the end of the URL still expires every 30 days (your
-bookmark needs refreshing then, on purpose). The only difference is that
-every new session opens at *your* address instead of a random one.
+Every new session opens at *your* address instead of a random one, and the
+secret path at the end of the URL still expires every 30 days (your bookmark
+needs refreshing then, on purpose).
+
+### Keeping it up after you close the terminal
+
+By default a session ends when you press Ctrl+C — fine for a quick lookup,
+useless if you want the bookmark to work while you're out. So:
+
+```bash
+paladin mobile -b          # background: survives closing the terminal
+paladin mobile --status    # what's running, and when the link expires
+paladin mobile --stop      # end it now
+```
+
+A background session keeps serving until you stop it or the link hits its
+30-day expiry, at which point it shuts itself down rather than lingering
+forever. What's exposed the whole time is the same encrypted blob as always
+— useless without the master password — behind a random 128-bit path.
 
 The one thing crossing the internet is the encrypted blob, which is useless
 without the master password that never leaves your phone. The tunnel provider
@@ -211,8 +226,11 @@ Both are thin skins over the two modules above. The TUI (built with
 [Textual](https://textual.textualize.io)) holds the decrypted entries in
 memory for the session; the CLI re-derives the key per command.
 
-Passwords go to the clipboard (`wl-copy`/`xclip`/`xsel`, whichever exists)
-rather than the screen, so they don't sit in your terminal scrollback. One
+Passwords go to the clipboard (`wl-copy`/`xclip`/`xsel`/`pbcopy`/`clip`,
+whichever exists) rather than the screen, so they don't sit in your terminal
+scrollback — and they're wiped from it 45 seconds later by a detached helper
+(the CLI exits immediately, so an in-process timer would never fire). If
+you've copied something else in the meantime, yours is left alone. One
 deliberate asymmetry: CLI `find` does *not* search passwords, because a CLI
 argument lands in your shell history forever — the TUI search box does,
 because nothing you type there is logged anywhere.
@@ -283,8 +301,10 @@ accounts from 2013. `paladin rm <name>` the corpses, or prune the CSV first.
 
 I'd rather you know these than find them:
 
-- No clipboard auto-clear yet: a copied password stays on the clipboard
-  until you copy over it. Copy something else when you're done.
+- The 45-second clipboard window is still a window: anything watching your
+  clipboard in that time sees the password. Set
+  `PALADIN_CLIPBOARD_SECONDS` lower if that bothers you (or `0` to keep the
+  old forever-behaviour).
 - While a command runs, decrypted data briefly exists in process memory.
   Malware already on your machine could read it — true of every password
   manager ever made; the vault protects the file at rest, not a compromised

{basic_password_manager-0.4.5 → basic_password_manager-0.4.7}/pw_manager/cli.py

@@ -23,23 +23,84 @@ def generate(length: int = 20) -> str:
     return "".join(secrets.choice(alphabet) for _ in range(length))
 
 
-def to_clipboard(text: str) -> bool:
-    # ponytail: no auto-clear timer; clear manually or copy something else over it
-    # linux needs a tool installed; macOS (pbcopy) and Windows (clip) ship theirs
-    for cmd in (
-        ["wl-copy"],
-        ["xclip", "-selection", "clipboard"],
-        ["xsel", "-b"],
-        ["pbcopy"],
-        ["clip"],
-        ["clip.exe"],  # windows tool as seen from inside WSL
-    ):
+# seconds a copied password lingers before it's wiped; 0 disables
+CLIPBOARD_TTL = int(os.environ.get("PALADIN_CLIPBOARD_SECONDS", "45"))
+
+# linux needs a tool installed; macOS (pbcopy) and Windows (clip) ship theirs
+_COPY_CMDS = (
+    ["wl-copy"],
+    ["xclip", "-selection", "clipboard"],
+    ["xsel", "-b"],
+    ["pbcopy"],
+    ["clip"],
+    ["clip.exe"],  # windows tool as seen from inside WSL
+)
+_PASTE_CMDS = (
+    ["wl-paste", "-n"],
+    ["xclip", "-selection", "clipboard", "-o"],
+    ["xsel", "-b"],
+    ["pbpaste"],
+    ["powershell.exe", "-noprofile", "-command", "Get-Clipboard"],
+)
+
+
+def to_clipboard(text: str, auto_clear: bool = True) -> bool:
+    for cmd in _COPY_CMDS:
         if shutil.which(cmd[0]):
             subprocess.run(cmd, input=text.encode(), check=True)
+            if auto_clear and text and CLIPBOARD_TTL > 0:
+                _clear_clipboard_later(text)
             return True
     return False
 
 
+def from_clipboard() -> str | None:
+    """Current clipboard contents, or None if we can't read it."""
+    for cmd in _PASTE_CMDS:
+        if shutil.which(cmd[0]):
+            try:
+                out = subprocess.run(cmd, capture_output=True, check=True).stdout
+            except subprocess.CalledProcessError:
+                return None
+            return out.decode(errors="replace").rstrip("\r\n")
+    return None
+
+
+def _clear_clipboard_later(text: str) -> None:
+    """Hand the password to a detached child that wipes it later — the CLI
+    exits immediately after copying, so an in-process timer would never fire."""
+    try:
+        proc = subprocess.Popen(
+            [sys.executable, "-c", "from pw_manager.cli import _clear_worker; _clear_worker()"],
+            stdin=subprocess.PIPE,
+            stdout=subprocess.DEVNULL,
+            stderr=subprocess.DEVNULL,
+            start_new_session=True,
+        )
+        proc.stdin.write(text.encode())  # via stdin, never argv (argv shows in `ps`)
+        proc.stdin.close()
+    except OSError:
+        pass  # clipboard hygiene is best-effort; never break the copy itself
+
+
+def _clear_worker() -> None:
+    """Child: wait out the TTL, then clear the clipboard only if it still holds
+    the password we put there — never clobber something the user copied since."""
+    import time
+
+    copied = sys.stdin.buffer.read().decode()
+    time.sleep(CLIPBOARD_TTL)
+    current = from_clipboard()
+    if current is None or current == copied:
+        to_clipboard("", auto_clear=False)  # no recursion
+
+
+def copied_msg() -> str:
+    if CLIPBOARD_TTL > 0:
+        return f"password copied to clipboard (clears in {CLIPBOARD_TTL}s)"
+    return "password copied to clipboard"
+
+
 def ask_master(confirm: bool = False) -> str:
     pw = getpass.getpass("master password: ")
     if confirm:
@@ -64,9 +125,28 @@ def cmd_init(args):
 
 
 def cmd_mobile(args):
+    import time
+
     from . import mobile
 
     try:
+        if args.stop:
+            print("background session stopped" if mobile.stop_daemon() else "nothing running")
+            return
+        if args.status:
+            state = mobile.read_state()
+            if not state:
+                print("no background session running")
+                return
+            left = (state["expires"] - time.time()) / 86400
+            print(f"serving {state['url']}\nlink expires in {left:.1f} days (pid {state['pid']})")
+            return
+        if args.background:
+            url = mobile.start_daemon(VAULT_PATH, stable_url=args.url)
+            mobile.print_qr(url)
+            print("  running in the background — it survives closing this terminal.")
+            print("  'paladin mobile --status' to check, '--stop' to end it.\n")
+            return
         mobile.run(VAULT_PATH, stable_url=args.url)
     except mobile.MobileError as e:
         sys.exit(str(e))
@@ -103,7 +183,7 @@ def cmd_add(args):
     vault.save(VAULT_PATH, master, entries)
     print(f"stored '{args.name}'")
     if args.gen and to_clipboard(pw):
-        print("password copied to clipboard")
+        print(copied_msg())
 
 
 def cmd_get(args):
@@ -115,7 +195,7 @@ def cmd_get(args):
     if e.get("notes"):
         print(f"notes:    {e['notes']}")
     if to_clipboard(e["pw"]):
-        print("password copied to clipboard")
+        print(copied_msg())
     else:
         # no clipboard tool found; showing it is the only option left
         print(f"password: {e['pw']}")
@@ -237,6 +317,12 @@ def main():
     i.add_argument("csv_file")
     m = sub.add_parser("mobile", help="open your vault on your phone over an HTTPS tunnel")
     m.add_argument("--url", help="serve at your own https subdomain instead of a quick tunnel")
+    m.add_argument(
+        "-b", "--background", action="store_true",
+        help="keep serving after this terminal closes (until the link expires)",
+    )
+    m.add_argument("--status", action="store_true", help="is a background session running?")
+    m.add_argument("--stop", action="store_true", help="stop the background session")
     sub.add_parser("about", help="meet the knight")
 
     args = p.parse_args()

{basic_password_manager-0.4.5 → basic_password_manager-0.4.7}/pw_manager/mobile.py

@@ -9,11 +9,13 @@ and the network only ever carry ciphertext.
 import base64
 import hashlib
 import http.server
+import json
 import os
 import platform
 import re
 import secrets
 import shutil
+import signal
 import stat
 import subprocess
 import sys
@@ -113,6 +115,81 @@ def _load_token() -> str:
     return token
 
 
+def token_expires_at() -> float:
+    """Unix time when the current link stops working."""
+    try:
+        created, _ = open(os.path.join(_data_dir(), "mobile-token")).read().split(":", 1)
+        return float(created) + TOKEN_TTL
+    except (OSError, ValueError):
+        return time.time() + TOKEN_TTL
+
+
+def _state_path() -> str:
+    return os.path.join(_data_dir(), "mobile-session.json")
+
+
+def read_state() -> dict | None:
+    """The running background session, or None if there isn't a live one."""
+    try:
+        with open(_state_path()) as f:
+            state = json.load(f)
+        os.kill(state["pid"], 0)  # raises if that process is gone
+        return state
+    except (OSError, ValueError, KeyError):
+        return None
+
+
+def stop_daemon() -> bool:
+    """Stop a background session. True if one was running."""
+    state = read_state()
+    if not state:
+        return False
+    try:
+        os.kill(state["pid"], signal.SIGTERM)
+    except OSError:
+        pass
+    try:
+        os.remove(_state_path())
+    except OSError:
+        pass
+    return True
+
+
+def start_daemon(vault_path: str, stable_url: str | None = None, port: int = 0) -> str:
+    """Re-launch ourselves detached so the session outlives this shell.
+    Returns the URL the background session is serving."""
+    if read_state():
+        raise MobileError("a background session is already running — 'paladin mobile --stop' first")
+    if not os.path.exists(vault_path):
+        raise MobileError(f"no vault at {vault_path} — run 'paladin init' first")
+
+    log = os.path.join(_data_dir(), "mobile.log")
+    cmd = [sys.executable, "-m", "pw_manager.cli", "mobile"]
+    if stable_url:
+        cmd += ["--url", stable_url]
+    env = {**os.environ, "PALADIN_MOBILE_DAEMON_CHILD": "1"}
+    with open(log, "ab") as logfile:
+        proc = subprocess.Popen(
+            cmd,
+            stdout=logfile,
+            stderr=logfile,
+            stdin=subprocess.DEVNULL,
+            start_new_session=True,  # survives this shell closing
+            env=env,
+        )
+    # wait for the child to publish its URL (tunnel start can take seconds)
+    deadline = time.time() + 45
+    while time.time() < deadline:
+        state = read_state()
+        if state and state.get("pid") == proc.pid:
+            return state["url"]
+        if proc.poll() is not None:
+            raise MobileError(f"background session failed to start — see {log}")
+        time.sleep(0.3)
+    proc.terminate()
+    raise MobileError(f"background session didn't come up in time — see {log}")
+
+
 def _theme_colors() -> dict:
     """Resolve the theme saved by the TUI to a full color palette. The page
     is baked with whatever theme is current when the QR is generated."""
@@ -251,13 +328,7 @@ def stop_session(server, proc) -> None:
         pass
 
 
-def run(vault_path: str, stable_url: str | None = None, port: int = 0) -> None:
-    def fetched():
-        print(f"  vault page served to a device at {time.strftime('%H:%M:%S')}")
-
-    print("\n  creating your secure link…", flush=True)
-    server, proc, url = start_session(vault_path, stable_url, port, on_fetch=fetched)
-
+def print_qr(url: str) -> None:
     import qrcode
 
     qr = qrcode.QRCode(border=1)
@@ -265,13 +336,45 @@ def run(vault_path: str, stable_url: str | None = None, port: int = 0) -> None:
     print("\n  scan with your phone camera:\n")
     qr.print_ascii(invert=True)
     print(f"\n  {url}\n")
-    print("  the master password is typed on your phone; only ciphertext leaves this machine.")
-    print("  every page load is logged below — Ctrl+C to stop the session.\n")
+
+
+def run(vault_path: str, stable_url: str | None = None, port: int = 0) -> None:
+    is_child = os.environ.get("PALADIN_MOBILE_DAEMON_CHILD") == "1"
+
+    def fetched():
+        print(f"  vault page served to a device at {time.strftime('%H:%M:%S')}", flush=True)
+
+    print("\n  creating your secure link…", flush=True)
+    server, proc, url = start_session(vault_path, stable_url, port, on_fetch=fetched)
+
+    if proc is None:  # stable mode: serving your own address, no quick tunnel
+        print(
+            f"  serving your configured address on 127.0.0.1:{server.server_address[1]}"
+            " — your tunnel/proxy must forward to this port"
+        )
+    else:
+        print("  using a temporary tunnel (set PALADIN_MOBILE_URL for your own subdomain)")
+
+    expires = token_expires_at()
+    if is_child:  # background session: publish state so --status/--stop can find us
+        with open(_state_path(), "w") as f:
+            json.dump({"pid": os.getpid(), "url": url, "expires": expires}, f)
+        signal.signal(signal.SIGTERM, lambda *a: (_ for _ in ()).throw(KeyboardInterrupt))
+    else:
+        print_qr(url)
+        print("  the master password is typed on your phone; only ciphertext leaves this machine.")
+        print("  every page load is logged below — Ctrl+C to stop the session.\n")
 
     try:
-        while True:
+        while time.time() < expires:  # the link's 30 days, enforced for real
             time.sleep(1)
+        print("\nlink expired after 30 days — run 'paladin mobile' again for a fresh one.")
     except KeyboardInterrupt:
         print("\nsession ended.")
     finally:
         stop_session(server, proc)
+        if is_child:
+            try:
+                os.remove(_state_path())
+            except OSError:
+                pass

{basic_password_manager-0.4.5 → basic_password_manager-0.4.7}/pw_manager/tui.py

@@ -11,7 +11,7 @@ import time
 
 from rich.style import Style
 from rich.text import Text
-from textual.app import App, ComposeResult
+from textual.app import App, ComposeResult, SystemCommand
 from textual.binding import Binding
 from textual.command import DiscoveryHit, Hit, Hits, Provider
 from textual.containers import Vertical
@@ -21,7 +21,7 @@ from textual.widgets import DataTable, Footer, Input, Label, OptionList, Static
 from textual.widgets.option_list import Option
 
 from . import logo, vault
-from .cli import VAULT_PATH, generate, import_csv, to_clipboard
+from .cli import CLIPBOARD_TTL, VAULT_PATH, generate, import_csv, to_clipboard
 
 THEME_FILE = os.path.expanduser("~/.local/share/pw-manager/theme")
 
@@ -422,7 +422,8 @@ class MainScreen(Screen):
         if name is None:
             return
         if to_clipboard(self.app.entries[name]["pw"]):
-            self.notify(f"password for '{name}' copied", severity="information")
+            ttl = f" (clears in {CLIPBOARD_TTL}s)" if CLIPBOARD_TTL > 0 else ""
+            self.notify(f"password for '{name}' copied{ttl}", severity="information")
         else:
             self.notify(
                 "no clipboard tool found (on Linux: install wl-clipboard)",
@@ -476,7 +477,7 @@ class MainScreen(Screen):
         self.app.push_screen(ConfirmModal(f"delete '{name}'?"), done)
 
     def action_theme(self) -> None:
-        self.app.push_screen(ThemeModal())
+        self.app._theme()  # same picker the palette opens
 
     def action_search(self) -> None:
         self.query_one("#search", Input).focus()
@@ -612,6 +613,18 @@ class PwApp(App):
         with open(THEME_FILE, "w") as f:
             f.write(theme.name)
 
+    def get_system_commands(self, screen: Screen):
+        """Swap Textual's built-in 'Theme' entry for our picker, so the
+        palette and the `t` key open the same thing."""
+        for command in super().get_system_commands(screen):
+            if command.title == "Theme":
+                yield SystemCommand("Theme", "Change the current theme", self._theme)
+            else:
+                yield command
+
+    def _theme(self) -> None:
+        self.push_screen(ThemeModal())
+
     def _import_csv(self) -> None:
         def done(path: str | None) -> None:
             if not path:

{basic_password_manager-0.4.5 → basic_password_manager-0.4.7}/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "setuptools.build_meta"
 
 [project]
 name = "basic-password-manager"
-version = "0.4.5"
+version = "0.4.7"
 description = "The Paladin — a local encrypted password manager that lives in your terminal"
 readme = "README.md"
 license = "MIT"