keepassxc-cli 0.1.0__py3-none-any.whl

keepassxc_cli/__init__.py

@@ -0,0 +1 @@
+from __future__ import annotations

keepassxc_cli/__main__.py

@@ -0,0 +1,77 @@
+"""CLI entry point for keepassxc-cli."""
+from __future__ import annotations
+
+import argparse
+import json
+import logging
+import sys
+from pathlib import Path
+
+from keepassxc_browser_api import BrowserClient, BrowserConfig
+from keepassxc_browser_api.exceptions import KeePassXCError, ConnectionError
+
+from .config import CliConfig, DEFAULT_CLI_CONFIG_PATH
+from .commands import setup, status, show, search, ls, add, edit, rm, totp, clip, generate, lock, mkdir
+
+
+def main() -> None:
+    parser = argparse.ArgumentParser(
+        prog="keepassxc-cli",
+        description="CLI for KeePassXC using the browser extension protocol with biometric unlock",
+    )
+    parser.add_argument(
+        "--config",
+        default=str(DEFAULT_CLI_CONFIG_PATH),
+        help="Path to CLI config file (default: %(default)s)",
+    )
+    parser.add_argument(
+        "--browser-api-config",
+        default=None,
+        help="Path to browser API config file",
+    )
+    parser.add_argument(
+        "--format",
+        choices=["table", "json", "tsv"],
+        default=None,
+        dest="fmt",
+        help="Output format (default: table)",
+    )
+    parser.add_argument("-v", "--verbose", action="store_true", help="Enable verbose logging")
+
+    subparsers = parser.add_subparsers(dest="command", metavar="COMMAND")
+    subparsers.required = True
+
+    setup.add_parser(subparsers)
+    status.add_parser(subparsers)
+    show.add_parser(subparsers)
+    search.add_parser(subparsers)
+    ls.add_parser(subparsers)
+    add.add_parser(subparsers)
+    edit.add_parser(subparsers)
+    rm.add_parser(subparsers)
+    totp.add_parser(subparsers)
+    clip.add_parser(subparsers)
+    generate.add_parser(subparsers)
+    lock.add_parser(subparsers)
+    mkdir.add_parser(subparsers)
+
+    args = parser.parse_args()
+
+    if args.verbose:
+        logging.basicConfig(level=logging.DEBUG)
+
+    cli_config_path = Path(args.config)
+    cli_config = CliConfig.load(cli_config_path)
+
+    browser_api_config_path = Path(args.browser_api_config or cli_config.browser_api_config_path)
+    browser_config = BrowserConfig.load(browser_api_config_path)
+
+    fmt = args.fmt or cli_config.default_format
+
+    client = BrowserClient(browser_config)
+    try:
+        rc = args.func(client, args, cli_config, browser_config, browser_api_config_path, fmt=fmt)
+    except (KeePassXCError, ConnectionError, OSError, json.JSONDecodeError) as e:
+        print(f"Error: {e}", file=sys.stderr)
+        rc = 1
+    sys.exit(rc)

keepassxc_cli/commands/__init__.py

@@ -0,0 +1 @@
+from __future__ import annotations

keepassxc_cli/commands/add.py

@@ -0,0 +1,48 @@
+from __future__ import annotations
+
+import argparse
+import getpass
+import sys
+from pathlib import Path
+
+from keepassxc_browser_api import BrowserClient, BrowserConfig
+
+from keepassxc_cli.config import CliConfig
+
+
+def add_parser(subparsers: argparse._SubParsersAction) -> None:
+    p = subparsers.add_parser("add", help="Add a new entry")
+    p.add_argument("--url", required=True, help="Entry URL")
+    p.add_argument("--username", required=True, help="Username")
+    p.add_argument("--password", default=None, help="Password (prompted if omitted)")
+    p.add_argument("--title", default="", help="Entry title")
+    p.add_argument("--group-uuid", default="", help="Target group UUID")
+    p.set_defaults(func=run)
+
+
+def run(
+    client: BrowserClient,
+    args: argparse.Namespace,
+    cli_config: CliConfig,
+    browser_config: BrowserConfig,
+    browser_config_path: Path,
+    *,
+    fmt: str = "table",
+) -> int:
+    password = args.password
+    if password is None:
+        password = getpass.getpass("Password: ")
+
+    success = client.set_login(
+        url=args.url,
+        username=args.username,
+        password=password,
+        title=args.title,
+        group_uuid=args.group_uuid,
+    )
+    if success:
+        print("Entry added successfully.")
+        return 0
+    else:
+        print("Failed to add entry.", file=sys.stderr)
+        return 1

keepassxc_cli/commands/clip.py

@@ -0,0 +1,61 @@
+from __future__ import annotations
+
+import argparse
+import sys
+from pathlib import Path
+
+from keepassxc_browser_api import BrowserClient, BrowserConfig
+
+from keepassxc_cli.config import CliConfig
+
+
+def add_parser(subparsers: argparse._SubParsersAction) -> None:
+    p = subparsers.add_parser("clip", help="Copy a field to clipboard")
+    p.add_argument("url", help="URL to look up")
+    p.add_argument(
+        "--field",
+        choices=["password", "username", "totp"],
+        default="password",
+        help="Field to copy (default: password)",
+    )
+    p.set_defaults(func=run)
+
+
+def run(
+    client: BrowserClient,
+    args: argparse.Namespace,
+    cli_config: CliConfig,
+    browser_config: BrowserConfig,
+    browser_config_path: Path,
+    *,
+    fmt: str = "table",
+) -> int:
+    try:
+        import pyperclip
+    except ImportError:
+        print("Error: pyperclip is required for clipboard support. Install it with: pip install pyperclip", file=sys.stderr)
+        return 1
+
+    entries = client.get_logins(args.url)
+    if not entries:
+        print(f"No entries found for: {args.url}", file=sys.stderr)
+        return 1
+
+    entry = entries[0]
+
+    if args.field == "password":
+        value = entry.password
+    elif args.field == "username":
+        value = entry.login
+    elif args.field == "totp":
+        value = client.get_totp(entry.uuid)
+        if value is None:
+            print(f"No TOTP for entry: {entry.uuid}", file=sys.stderr)
+            return 1
+    else:
+        print(f"Unknown field: {args.field}", file=sys.stderr)
+        return 1
+
+    pyperclip.copy(value)
+    print(f"Copied {args.field} to clipboard.")
+    return 0

keepassxc_cli/commands/edit.py

@@ -0,0 +1,56 @@
+from __future__ import annotations
+
+import argparse
+import sys
+from pathlib import Path
+
+from keepassxc_browser_api import BrowserClient, BrowserConfig
+
+from keepassxc_cli.config import CliConfig
+
+
+def add_parser(subparsers: argparse._SubParsersAction) -> None:
+    p = subparsers.add_parser("edit", help="Edit an existing entry by UUID")
+    p.add_argument("uuid", help="UUID of the entry to edit")
+    p.add_argument("--url", default=None, help="New URL")
+    p.add_argument("--username", default=None, help="New username")
+    p.add_argument("--password", default=None, help="New password")
+    p.add_argument("--title", default=None, help="New title")
+    p.set_defaults(func=run)
+
+
+def run(
+    client: BrowserClient,
+    args: argparse.Namespace,
+    cli_config: CliConfig,
+    browser_config: BrowserConfig,
+    browser_config_path: Path,
+    *,
+    fmt: str = "table",
+) -> int:
+    all_entries = client.get_database_entries()
+    entry = next((e for e in all_entries if e.uuid == args.uuid), None)
+    if entry is None:
+        print(f"Entry not found: {args.uuid}", file=sys.stderr)
+        return 1
+
+    # Determine the URL to use for set_login (required by the API)
+    url = args.url or next(
+        (sf.get("KPH: url", "") for sf in entry.string_fields if "KPH: url" in sf),
+        "",
+    )
+
+    success = client.set_login(
+        url=url,
+        username=args.username if args.username is not None else entry.login,
+        password=args.password if args.password is not None else entry.password,
+        title=args.title if args.title is not None else entry.name,
+        uuid=entry.uuid,
+        group_uuid=entry.group_uuid,
+    )
+    if success:
+        print("Entry updated successfully.")
+        return 0
+    else:
+        print("Failed to update entry.", file=sys.stderr)
+        return 1

keepassxc_cli/commands/generate.py

@@ -0,0 +1,47 @@
+from __future__ import annotations
+
+import argparse
+import sys
+from pathlib import Path
+
+from keepassxc_browser_api import BrowserClient, BrowserConfig
+
+from keepassxc_cli.config import CliConfig
+from keepassxc_cli.output import print_password
+
+
+def add_parser(subparsers: argparse._SubParsersAction) -> None:
+    p = subparsers.add_parser(
+        "generate",
+        help="Generate a password using KeePassXC's configured password profile",
+    )
+    p.add_argument("--clip", action="store_true", help="Copy to clipboard instead of printing")
+    p.set_defaults(func=run)
+
+
+def run(
+    client: BrowserClient,
+    args: argparse.Namespace,
+    cli_config: CliConfig,
+    browser_config: BrowserConfig,
+    browser_config_path: Path,
+    *,
+    fmt: str = "table",
+) -> int:
+    password = client.generate_password()
+    if password is None:
+        print("Failed to generate password.", file=sys.stderr)
+        return 1
+
+    if args.clip:
+        try:
+            import pyperclip
+            pyperclip.copy(password)
+            print("Password copied to clipboard.")
+        except ImportError:
+            print("Error: pyperclip is required for clipboard support. Install it with: pip install pyperclip", file=sys.stderr)
+            return 1
+    else:
+        print_password(password, fmt)
+
+    return 0

keepassxc_cli/commands/lock.py

@@ -0,0 +1,32 @@
+from __future__ import annotations
+
+import argparse
+import sys
+from pathlib import Path
+
+from keepassxc_browser_api import BrowserClient, BrowserConfig
+
+from keepassxc_cli.config import CliConfig
+
+
+def add_parser(subparsers: argparse._SubParsersAction) -> None:
+    p = subparsers.add_parser("lock", help="Lock the KeePassXC database")
+    p.set_defaults(func=run)
+
+
+def run(
+    client: BrowserClient,
+    args: argparse.Namespace,
+    cli_config: CliConfig,
+    browser_config: BrowserConfig,
+    browser_config_path: Path,
+    *,
+    fmt: str = "table",
+) -> int:
+    success = client.lock_database()
+    if success:
+        print("Database locked.")
+        return 0
+    else:
+        print("Failed to lock database.", file=sys.stderr)
+        return 1

keepassxc_cli/commands/ls.py

@@ -0,0 +1,33 @@
+from __future__ import annotations
+
+import argparse
+from pathlib import Path
+
+from keepassxc_browser_api import BrowserClient, BrowserConfig
+
+from keepassxc_cli.config import CliConfig
+from keepassxc_cli.output import print_entries, print_groups
+
+
+def add_parser(subparsers: argparse._SubParsersAction) -> None:
+    p = subparsers.add_parser("ls", help="List database entries or groups")
+    p.add_argument("--groups", action="store_true", help="List groups instead of entries")
+    p.set_defaults(func=run)
+
+
+def run(
+    client: BrowserClient,
+    args: argparse.Namespace,
+    cli_config: CliConfig,
+    browser_config: BrowserConfig,
+    browser_config_path: Path,
+    *,
+    fmt: str = "table",
+) -> int:
+    if args.groups:
+        groups = client.get_database_groups()
+        print_groups(groups, fmt)
+    else:
+        entries = client.get_database_entries()
+        print_entries(entries, fmt)
+    return 0

keepassxc_cli/commands/mkdir.py

@@ -0,0 +1,33 @@
+from __future__ import annotations
+
+import argparse
+import sys
+from pathlib import Path
+
+from keepassxc_browser_api import BrowserClient, BrowserConfig
+
+from keepassxc_cli.config import CliConfig
+
+
+def add_parser(subparsers: argparse._SubParsersAction) -> None:
+    p = subparsers.add_parser("mkdir", help="Create a new group")
+    p.add_argument("name", help="Group name")
+    p.add_argument("--parent-uuid", default="", help="Parent group UUID")
+    p.set_defaults(func=run)
+
+
+def run(
+    client: BrowserClient,
+    args: argparse.Namespace,
+    cli_config: CliConfig,
+    browser_config: BrowserConfig,
+    browser_config_path: Path,
+    *,
+    fmt: str = "table",
+) -> int:
+    group = client.create_group(args.name, parent_group_uuid=args.parent_uuid)
+    if group is None:
+        print("Failed to create group.", file=sys.stderr)
+        return 1
+    print(f"Group created: {group.name} [{group.uuid}]")
+    return 0

keepassxc_cli/commands/rm.py

@@ -0,0 +1,40 @@
+from __future__ import annotations
+
+import argparse
+import sys
+from pathlib import Path
+
+from keepassxc_browser_api import BrowserClient, BrowserConfig
+
+from keepassxc_cli.config import CliConfig
+
+
+def add_parser(subparsers: argparse._SubParsersAction) -> None:
+    p = subparsers.add_parser("rm", help="Delete an entry by UUID")
+    p.add_argument("uuid", help="UUID of the entry to delete")
+    p.add_argument("-y", "--yes", action="store_true", help="Skip confirmation prompt")
+    p.set_defaults(func=run)
+
+
+def run(
+    client: BrowserClient,
+    args: argparse.Namespace,
+    cli_config: CliConfig,
+    browser_config: BrowserConfig,
+    browser_config_path: Path,
+    *,
+    fmt: str = "table",
+) -> int:
+    if not args.yes:
+        answer = input(f"Delete entry {args.uuid}? [y/N] ").strip().lower()
+        if answer != "y":
+            print("Aborted.")
+            return 1
+
+    success = client.delete_entry(args.uuid)
+    if success:
+        print("Entry deleted.")
+        return 0
+    else:
+        print("Failed to delete entry.", file=sys.stderr)
+        return 1

keepassxc_cli/commands/search.py

@@ -0,0 +1,41 @@
+from __future__ import annotations
+
+import argparse
+import sys
+from pathlib import Path
+
+from keepassxc_browser_api import BrowserClient, BrowserConfig
+
+from keepassxc_cli.config import CliConfig
+from keepassxc_cli.output import print_entries
+
+
+def add_parser(subparsers: argparse._SubParsersAction) -> None:
+    p = subparsers.add_parser("search", help="Search all database entries")
+    p.add_argument("query", help="Search query (case-insensitive match on title, username, or URL)")
+    p.add_argument("-p", "--show-password", action="store_true", help="Reveal password")
+    p.set_defaults(func=run)
+
+
+def run(
+    client: BrowserClient,
+    args: argparse.Namespace,
+    cli_config: CliConfig,
+    browser_config: BrowserConfig,
+    browser_config_path: Path,
+    *,
+    fmt: str = "table",
+) -> int:
+    query = args.query.lower()
+    all_entries = client.get_database_entries()
+    matches = [
+        e for e in all_entries
+        if query in e.name.lower()
+        or query in e.login.lower()
+        or any(query in v.lower() for sf in e.string_fields for v in sf.values() if v is not None)
+    ]
+    if not matches:
+        print(f"No entries found matching: {args.query}", file=sys.stderr)
+        return 1
+    print_entries(matches, fmt, show_password=args.show_password)
+    return 0

keepassxc_cli/commands/setup.py

@@ -0,0 +1,33 @@
+from __future__ import annotations
+
+import argparse
+import sys
+from pathlib import Path
+
+from keepassxc_browser_api import BrowserClient, BrowserConfig
+
+from keepassxc_cli.config import CliConfig
+
+
+def add_parser(subparsers: argparse._SubParsersAction) -> None:
+    p = subparsers.add_parser("setup", help="Associate with KeePassXC (key exchange)")
+    p.set_defaults(func=run)
+
+
+def run(
+    client: BrowserClient,
+    args: argparse.Namespace,
+    cli_config: CliConfig,
+    browser_config: BrowserConfig,
+    browser_config_path: Path,
+    *,
+    fmt: str = "table",
+) -> int:
+    success = client.setup()
+    if success:
+        browser_config.save(browser_config_path)
+        print("Successfully associated with KeePassXC.")
+        return 0
+    else:
+        print("Failed to associate with KeePassXC.", file=sys.stderr)
+        return 1

keepassxc_cli/commands/show.py

@@ -0,0 +1,37 @@
+from __future__ import annotations
+
+import argparse
+import sys
+from pathlib import Path
+
+from keepassxc_browser_api import BrowserClient, BrowserConfig
+
+from keepassxc_cli.config import CliConfig
+from keepassxc_cli.output import print_entry_detail
+
+
+def add_parser(subparsers: argparse._SubParsersAction) -> None:
+    p = subparsers.add_parser("show", help="Show entries matching a URL")
+    p.add_argument("url", help="URL or search string")
+    p.add_argument("-p", "--show-password", action="store_true", help="Reveal password")
+    p.set_defaults(func=run)
+
+
+def run(
+    client: BrowserClient,
+    args: argparse.Namespace,
+    cli_config: CliConfig,
+    browser_config: BrowserConfig,
+    browser_config_path: Path,
+    *,
+    fmt: str = "table",
+) -> int:
+    entries = client.get_logins(args.url)
+    if not entries:
+        print(f"No entries found for: {args.url}", file=sys.stderr)
+        return 1
+    for entry in entries:
+        print_entry_detail(entry, fmt, show_password=args.show_password)
+        if fmt == "table" and len(entries) > 1:
+            print()
+    return 0

keepassxc_cli/commands/status.py

@@ -0,0 +1,49 @@
+from __future__ import annotations
+
+import argparse
+from pathlib import Path
+
+from keepassxc_browser_api import BrowserClient, BrowserConfig
+from keepassxc_browser_api.exceptions import KeePassXCError
+
+from keepassxc_cli.config import CliConfig
+from keepassxc_cli.output import print_status
+
+
+def add_parser(subparsers: argparse._SubParsersAction) -> None:
+    p = subparsers.add_parser("status", help="Show KeePassXC connection and association status")
+    p.set_defaults(func=run)
+
+
+def run(
+    client: BrowserClient,
+    args: argparse.Namespace,
+    cli_config: CliConfig,
+    browser_config: BrowserConfig,
+    browser_config_path: Path,
+    *,
+    fmt: str = "table",
+) -> int:
+    info: dict = {}
+
+    connected = client.connect()
+    info["Connected"] = "yes" if connected else "no"
+
+    if not connected:
+        print_status(info, fmt)
+        return 1
+
+    associated = False
+    if browser_config.associations:
+        try:
+            association = next(iter(browser_config.associations.values()))
+            associated = client.test_associate(association)
+        except KeePassXCError:
+            associated = False
+
+    info["Associated"] = "yes" if associated else "no"
+    info["Unlock timeout"] = str(browser_config.unlock_timeout)
+
+    client.disconnect()
+    print_status(info, fmt)
+    return 0

keepassxc_cli/commands/totp.py

@@ -0,0 +1,33 @@
+from __future__ import annotations
+
+import argparse
+import sys
+from pathlib import Path
+
+from keepassxc_browser_api import BrowserClient, BrowserConfig
+
+from keepassxc_cli.config import CliConfig
+from keepassxc_cli.output import print_totp
+
+
+def add_parser(subparsers: argparse._SubParsersAction) -> None:
+    p = subparsers.add_parser("totp", help="Get TOTP code for an entry")
+    p.add_argument("uuid", help="UUID of the entry")
+    p.set_defaults(func=run)
+
+
+def run(
+    client: BrowserClient,
+    args: argparse.Namespace,
+    cli_config: CliConfig,
+    browser_config: BrowserConfig,
+    browser_config_path: Path,
+    *,
+    fmt: str = "table",
+) -> int:
+    totp = client.get_totp(args.uuid)
+    if totp is None:
+        print(f"No TOTP for entry: {args.uuid}", file=sys.stderr)
+        return 1
+    print_totp(totp, fmt)
+    return 0

keepassxc_cli/config.py

@@ -0,0 +1,50 @@
+from __future__ import annotations
+
+import json
+import os
+from dataclasses import dataclass, field
+from pathlib import Path
+
+DEFAULT_BROWSER_API_CONFIG_PATH = str(Path.home() / ".keepassxc" / "browser-api.json")
+DEFAULT_CLI_CONFIG_PATH = Path.home() / ".keepassxc" / "cli.json"
+
+
+@dataclass
+class CliConfig:
+    browser_api_config_path: str = field(default_factory=lambda: DEFAULT_BROWSER_API_CONFIG_PATH)
+    default_format: str = "table"
+
+    def to_dict(self) -> dict:
+        d: dict = {}
+        if self.browser_api_config_path != DEFAULT_BROWSER_API_CONFIG_PATH:
+            d["browser_api_config_path"] = self.browser_api_config_path
+        if self.default_format != "table":
+            d["default_format"] = self.default_format
+        return d
+
+    @classmethod
+    def from_dict(cls, d: dict) -> CliConfig:
+        return cls(
+            browser_api_config_path=d.get("browser_api_config_path", DEFAULT_BROWSER_API_CONFIG_PATH),
+            default_format=d.get("default_format", "table"),
+        )
+
+    def save(self, path: Path | str) -> None:
+        path = Path(path)
+        path.parent.mkdir(parents=True, exist_ok=True)
+        data = json.dumps(self.to_dict(), indent=2)
+        # Write with restricted permissions (0o600)
+        fd = os.open(path, os.O_WRONLY | os.O_CREAT | os.O_TRUNC, 0o600)
+        try:
+            os.write(fd, data.encode())
+        finally:
+            os.close(fd)
+
+    @classmethod
+    def load(cls, path: Path | str) -> CliConfig:
+        path = Path(path)
+        if not path.exists():
+            return cls()
+        with open(path) as f:
+            d = json.load(f)
+        return cls.from_dict(d)

keepassxc_cli/output.py

@@ -0,0 +1,167 @@
+from __future__ import annotations
+
+import json
+
+from keepassxc_browser_api import Entry, Group
+
+
+def _truncate(s: str, n: int) -> str:
+    if len(s) > n:
+        return s[: n - 1] + "…"
+    return s
+
+
+def _table_row(cols: list[str], widths: list[int]) -> str:
+    return "| " + " | ".join(v.ljust(w) for v, w in zip(cols, widths)) + " |"
+
+
+def _table_sep(widths: list[int]) -> str:
+    return "+-" + "-+-".join("-" * w for w in widths) + "-+"
+
+
+def _print_table(headers: list[str], rows: list[list[str]]) -> None:
+    widths = [len(h) for h in headers]
+    for row in rows:
+        for i, cell in enumerate(row):
+            widths[i] = max(widths[i], len(cell))
+    sep = _table_sep(widths)
+    print(sep)
+    print(_table_row(headers, widths))
+    print(sep)
+    for row in rows:
+        print(_table_row(row, widths))
+    print(sep)
+
+
+def print_entries(entries: list[Entry], fmt: str = "table", show_password: bool = False) -> None:
+    if fmt == "json":
+        data = [
+            {
+                "uuid": e.uuid,
+                "name": e.name,
+                "login": e.login,
+                "password": e.password if show_password else "***",
+                "url": next((sf.get("KPH: url", "") for sf in e.string_fields if "KPH: url" in sf), ""),
+                "group": e.group,
+            }
+            for e in entries
+        ]
+        print(json.dumps(data, indent=2))
+        return
+
+    if fmt == "tsv":
+        headers = ["UUID", "Title", "Username", "URL", "Group"]
+        print("\t".join(headers))
+        for e in entries:
+            url = next((sf.get("KPH: url", "") for sf in e.string_fields if "KPH: url" in sf), "")
+            print("\t".join([e.uuid, e.name, e.login, url, e.group]))
+        return
+
+    # table
+    headers = ["UUID", "Title", "Username", "URL", "Group"]
+    rows = []
+    for e in entries:
+        url = next((sf.get("KPH: url", "") for sf in e.string_fields if "KPH: url" in sf), "")
+        rows.append([_truncate(e.uuid, 9), e.name, e.login, url, e.group])
+    _print_table(headers, rows)
+
+
+def _print_group_tree(group: Group, indent: int = 0) -> None:
+    prefix = "  " * indent
+    print(f"{prefix}{group.name}  [{_truncate(group.uuid, 9)}]")
+    for child in group.children:
+        _print_group_tree(child, indent + 1)
+
+
+def print_groups(groups: list[Group], fmt: str = "table") -> None:
+    if fmt == "json":
+        def _g2d(g: Group) -> dict:
+            return {"uuid": g.uuid, "name": g.name, "children": [_g2d(c) for c in g.children]}
+        print(json.dumps([_g2d(g) for g in groups], indent=2))
+        return
+
+    if fmt == "tsv":
+        print("UUID\tName")
+        for g in groups:
+            for flat in g.flat_list():
+                print(f"{flat.uuid}\t{flat.name}")
+        return
+
+    for g in groups:
+        _print_group_tree(g)
+
+
+def print_entry_detail(entry: Entry, fmt: str = "table", show_password: bool = False) -> None:
+    password = entry.password if show_password else "***"
+    if fmt == "json":
+        data = {
+            "uuid": entry.uuid,
+            "name": entry.name,
+            "login": entry.login,
+            "password": password,
+            "totp": entry.totp,
+            "group": entry.group,
+            "group_uuid": entry.group_uuid,
+            "string_fields": entry.string_fields,
+        }
+        print(json.dumps(data, indent=2))
+        return
+
+    if fmt == "tsv":
+        print("Field\tValue")
+        print(f"UUID\t{entry.uuid}")
+        print(f"Title\t{entry.name}")
+        print(f"Username\t{entry.login}")
+        print(f"Password\t{password}")
+        print(f"TOTP\t{entry.totp}")
+        print(f"Group\t{entry.group}")
+        print(f"Group UUID\t{entry.group_uuid}")
+        return
+
+    print(f"UUID:       {entry.uuid}")
+    print(f"Title:      {entry.name}")
+    print(f"Username:   {entry.login}")
+    print(f"Password:   {password}")
+    if entry.totp:
+        print(f"TOTP:       {entry.totp}")
+    if entry.group:
+        print(f"Group:      {entry.group}")
+    if entry.group_uuid:
+        print(f"Group UUID: {entry.group_uuid}")
+    if entry.string_fields:
+        for sf in entry.string_fields:
+            for k, v in sf.items():
+                print(f"{k}: {v}")
+
+
+def print_totp(totp: str, fmt: str = "table") -> None:
+    if fmt == "json":
+        print(json.dumps({"totp": totp}, indent=2))
+        return
+    if fmt == "tsv":
+        print(f"TOTP\t{totp}")
+        return
+    print(totp)
+
+
+def print_password(password: str, fmt: str = "table") -> None:
+    if fmt == "json":
+        print(json.dumps({"password": password}, indent=2))
+        return
+    if fmt == "tsv":
+        print(f"Password\t{password}")
+        return
+    print(password)
+
+
+def print_status(info: dict, fmt: str = "table") -> None:
+    if fmt == "json":
+        print(json.dumps(info, indent=2))
+        return
+    if fmt == "tsv":
+        print("Key\tValue")
+        for k, v in info.items():
+            print(f"{k}\t{v}")
+        return
+    for k, v in info.items():
+        print(f"{k}: {v}")

keepassxc_cli-0.1.0.dist-info/METADATA

@@ -0,0 +1,226 @@
+Metadata-Version: 2.4
+Name: keepassxc-cli
+Version: 0.1.0
+Summary: CLI for KeePassXC using the browser extension protocol with biometric unlock
+License-Expression: MIT
+Requires-Python: >=3.10
+Description-Content-Type: text/markdown
+License-File: LICENSE
+Requires-Dist: keepassxc-browser-api==0.1.0
+Requires-Dist: pyperclip>=1.8.0
+Provides-Extra: dev
+Requires-Dist: pytest>=7.0; extra == "dev"
+Requires-Dist: pytest-cov>=4.0; extra == "dev"
+Dynamic: license-file
+
+# keepassxc-cli
+
+A command-line interface for [KeePassXC](https://keepassxc.org/) that communicates via the browser extension protocol, supporting biometric (TouchID/fingerprint) unlock on supported platforms.
+
+## What it is
+
+`keepassxc-cli` talks to a running KeePassXC instance using the same native messaging protocol used by the KeePassXC Browser extension. This means:
+
+- **Biometric unlock**: On macOS with TouchID (or similar) configured in KeePassXC, you can authenticate via fingerprint rather than typing your master password.
+- **No master password in shell history**: Authentication happens through KeePassXC's GUI, not the terminal.
+- **Full CRUD**: List, search, add, edit, delete entries and groups.
+- **TOTP**: Retrieve time-based one-time passwords.
+- **Clipboard**: Copy credentials directly to the clipboard.
+
+## Prerequisites
+
+1. **KeePassXC** ≥ 2.7 with the **Browser Integration** feature enabled:
+   - Open KeePassXC → Tools → Settings → Browser Integration
+   - Enable "Enable browser integration"
+2. A KeePassXC database must be open (or KeePassXC must be running with auto-open configured).
+3. Python ≥ 3.10
+
+## Installation
+
+```bash
+pipx install keepassxc-cli
+```
+
+Or with pip:
+
+```bash
+pip install keepassxc-cli
+```
+
+## Setup
+
+Before using `keepassxc-cli`, associate it with your KeePassXC instance:
+
+```bash
+keepassxc-cli setup
+```
+
+This performs a key exchange with KeePassXC (you will be prompted to allow the association in the KeePassXC GUI). The association is saved to `~/.keepassxc/browser-api.json`.
+
+## Usage
+
+### Global options
+
+```
+keepassxc-cli [--config PATH] [--browser-api-config PATH] [--format {table,json,tsv}] [-v] COMMAND
+```
+
+| Option | Description |
+|--------|-------------|
+| `--config` | Path to CLI config file (default: `~/.keepassxc/cli.json`) |
+| `--browser-api-config` | Path to browser API config file (default: `~/.keepassxc/browser-api.json`) |
+| `--format` | Output format: `table` (default), `json`, or `tsv` |
+| `-v, --verbose` | Enable verbose/debug logging |
+
+### Commands
+
+#### `setup` — Associate with KeePassXC
+
+```bash
+keepassxc-cli setup
+```
+
+#### `status` — Connection and association status
+
+```bash
+keepassxc-cli status
+```
+
+#### `ls` — List entries or groups
+
+```bash
+keepassxc-cli ls                # list all entries (includes UUID column)
+keepassxc-cli ls --groups       # list groups (tree view)
+keepassxc-cli ls --format json  # output as JSON
+```
+
+UUIDs shown in the output are needed for `edit`, `rm`, `totp`, and `clip --field totp`.
+
+#### `search` — Search entries
+
+```bash
+keepassxc-cli search github
+keepassxc-cli search "my bank" --show-password
+```
+
+Searches case-insensitively across title, username, and URL fields.
+
+#### `show` — Show entries for a URL
+
+```bash
+keepassxc-cli show https://github.com
+keepassxc-cli show https://github.com -p   # reveal password
+```
+
+#### `add` — Add a new entry
+
+```bash
+keepassxc-cli add --url https://example.com --username user@example.com --title "Example"
+# Password will be prompted securely if --password is not given
+keepassxc-cli add --url https://example.com --username user --password mypass
+```
+
+#### `edit` — Edit an entry
+
+> **Finding a UUID**: Use `keepassxc-cli ls` or `keepassxc-cli search <query>` to list entries with their UUIDs.
+
+```bash
+keepassxc-cli edit <uuid> --username newuser
+keepassxc-cli edit <uuid> --password newpass --title "New Title"
+```
+
+#### `rm` — Delete an entry
+
+```bash
+keepassxc-cli rm <uuid>          # prompts for confirmation
+keepassxc-cli rm <uuid> --yes    # skip confirmation
+```
+
+#### `totp` — Get TOTP code
+
+```bash
+keepassxc-cli totp <uuid>
+```
+
+#### `clip` — Copy to clipboard
+
+```bash
+keepassxc-cli clip https://github.com              # copies password
+keepassxc-cli clip https://github.com --field username
+keepassxc-cli clip https://github.com --field totp
+```
+
+#### `generate` — Generate a password
+
+```bash
+keepassxc-cli generate
+keepassxc-cli generate --length 32 --symbols
+keepassxc-cli generate --no-numbers --no-uppercase
+keepassxc-cli generate --clip    # copy to clipboard instead of printing
+```
+
+#### `lock` — Lock the database
+
+```bash
+keepassxc-cli lock
+```
+
+#### `mkdir` — Create a group
+
+```bash
+keepassxc-cli mkdir "Work"
+keepassxc-cli mkdir "Projects" --parent-uuid <parent-group-uuid>
+```
+
+## Configuration
+
+### CLI config (`~/.keepassxc/cli.json`)
+
+Only non-default values are stored. Available options:
+
+| Key | Default | Description |
+|-----|---------|-------------|
+| `browser_api_config_path` | `~/.keepassxc/browser-api.json` | Path to the browser API config |
+| `default_format` | `table` | Default output format (`table`, `json`, `tsv`) |
+
+Example `~/.keepassxc/cli.json`:
+```json
+{
+  "default_format": "json"
+}
+```
+
+### Browser API config (`~/.keepassxc/browser-api.json`)
+
+Shared with `keepassxc-browser-api`. Contains the association keys created during `keepassxc-cli setup`. This file is automatically created and updated by the `setup` command.
+
+Both config files are stored with `0o600` permissions (owner read/write only).
+
+## Development
+
+```bash
+git clone https://github.com/mietzen/keepassxc-cli
+cd keepassxc-cli
+
+python3 -m venv .venv
+source .venv/bin/activate
+
+# Install local keepassxc-browser-api dependency first
+pip install ../mietzen-keepassxc-browser-api/
+
+# Install in editable mode with dev dependencies
+pip install -e ".[dev]"
+
+# Run tests
+pytest --tb=short -q
+
+# Run linter
+ruff check --ignore=E501 --exclude=__init__.py ./keepassxc_cli
+```
+
+## Known Limitations
+
+- Requires KeePassXC to be **running** and the database to be **open** (or biometric auto-unlock configured).
+- The `clip` and `generate --clip` commands require `pyperclip` and a working clipboard (e.g., `xclip`/`xsel` on Linux, built-in on macOS/Windows).
+- The browser integration protocol does not support moving entries between groups directly.
+- Entry URLs in the database are stored as `KPH: url` string fields; entries without a URL field may not appear in `show` results.

keepassxc_cli-0.1.0.dist-info/RECORD

@@ -0,0 +1,24 @@
+keepassxc_cli/__init__.py,sha256=U4S_2y3zgLZVfMenHRaJFBW8yqh2mUBuI291LGQVOJ8,35
+keepassxc_cli/__main__.py,sha256=kVXXp8Ts8LmotfJw0nL71M6kfe_3YRTekrvyVK-KNkg,2469
+keepassxc_cli/config.py,sha256=bgSllV9Vz6j-Xou_BLAvkoi_TWhXEeBsLlWteZAgxXc,1653
+keepassxc_cli/output.py,sha256=RXgmXSnyNyd6gr59_TdHFkR_xR-jcyBuITUopXuBdWE,5019
+keepassxc_cli/commands/__init__.py,sha256=U4S_2y3zgLZVfMenHRaJFBW8yqh2mUBuI291LGQVOJ8,35
+keepassxc_cli/commands/add.py,sha256=wAJ_V0sH1kXE3Dkvt7uEiBh2J7ZAKbgTveq7Eppib8I,1359
+keepassxc_cli/commands/clip.py,sha256=PvLT2ZKnr7phphPgQEZ0mTU7EwLDFiEbIaywF1XIXjw,1658
+keepassxc_cli/commands/edit.py,sha256=HnzyDZ7_6pxWBhh_alNtA48sUcTCtkC1-LREKcHJlSs,1816
+keepassxc_cli/commands/generate.py,sha256=dY1gE3aPHGVq09V0Vo-3TRlI7wsj-ZO84_2_frhZKac,1312
+keepassxc_cli/commands/lock.py,sha256=kHKd_H4z-gtCsyl_Tf9Tk8cbm2oeamyFFcgv-Nh7LZk,757
+keepassxc_cli/commands/ls.py,sha256=ZuQcxTrDt9CHzHBVTTXBbf9gq-27UL-JV613ffap1gg,917
+keepassxc_cli/commands/mkdir.py,sha256=mk8Fj2_QurccoLSjncZUxzpR9CkfYL7B2EkK1DtWqFs,925
+keepassxc_cli/commands/rm.py,sha256=r-iRFlID6f41pmKhAK9YAFjE-v7iW7ofSTWsfmf_6Vw,1082
+keepassxc_cli/commands/search.py,sha256=Wvdzb3L56mIA-XtophNlswuJBmVG081Us_eiB82dkks,1299
+keepassxc_cli/commands/setup.py,sha256=m8hyRpyPaRY07-iQItQXkrgbu5E6dwauplyxjI4oR8E,845
+keepassxc_cli/commands/show.py,sha256=AxhWLyCSFc3drFkU1iUySZuoKRqoifPuQHV4Nl1B55Q,1090
+keepassxc_cli/commands/status.py,sha256=f-5DJK1yAUWzaGe_EnqOWliwhlQo8e7Ugy1fqmxXO24,1320
+keepassxc_cli/commands/totp.py,sha256=jE6C8azlqMpuHoQa1y0JV27bVo0Pj-wewvP_WRdsfuM,844
+keepassxc_cli-0.1.0.dist-info/licenses/LICENSE,sha256=i7l1iI-cTPEtMrRCNzPD2_ZMZV0LQna7gPvYG0lVoCs,1061
+keepassxc_cli-0.1.0.dist-info/METADATA,sha256=dgvHoyFe4oc6RMdGPsAHN45XmWBRURasWSdYfJS0gFA,6471
+keepassxc_cli-0.1.0.dist-info/WHEEL,sha256=aeYiig01lYGDzBgS8HxWXOg3uV61G9ijOsup-k9o1sk,91
+keepassxc_cli-0.1.0.dist-info/entry_points.txt,sha256=nWY3_lURlCrN2WmUwkYzgEQByM204jRVL0NRlfpm2LM,62
+keepassxc_cli-0.1.0.dist-info/top_level.txt,sha256=Ac6eDBVHsCdXRS6v48vVgGyU0xVGoXXIc4DuNtFc6CY,14
+keepassxc_cli-0.1.0.dist-info/RECORD,,

keepassxc_cli-0.1.0.dist-info/WHEEL

@@ -0,0 +1,5 @@
+Wheel-Version: 1.0
+Generator: setuptools (82.0.1)
+Root-Is-Purelib: true
+Tag: py3-none-any
+

keepassxc_cli-0.1.0.dist-info/entry_points.txt

@@ -0,0 +1,2 @@
+[console_scripts]
+keepassxc-cli = keepassxc_cli.__main__:main

keepassxc_cli-0.1.0.dist-info/licenses/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 Nils
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

keepassxc_cli-0.1.0.dist-info/top_level.txt

@@ -0,0 +1 @@
+keepassxc_cli