keepassxc-cli 1.4.0__tar.gz → 1.6.0__tar.gz

{keepassxc_cli-1.4.0 → keepassxc_cli-1.6.0}/CLAUDE.md

@@ -1,12 +1,12 @@
-# CLAUDE.md — keepassxc-cli
+# keepassxc-cli - Claude Code Instructions
 
-This document provides context for AI assistants working on this project.
-
-## Project Purpose
+## Project Overview
 
 `keepassxc-cli` is a Python command-line tool that communicates with a running KeePassXC instance using the KeePassXC Browser Extension protocol (native messaging over a Unix socket). It enables terminal users to interact with KeePassXC — adding, editing, and deleting entries — while leveraging KeePassXC's biometric (TouchID/fingerprint) unlock support.
 
-## Package Structure
+## Architecture
+
+### Package Structure
 
 ```
 keepassxc_cli/
@@ -34,7 +34,7 @@ tests/
 └── test_commands.py     # command run() function tests with mocked BrowserClient
 ```
 
-## Dependency: keepassxc-browser-api
+### Dependencies
 
 This package depends on `keepassxc-browser-api` (local package at `../mietzen-keepassxc-browser-api/`), which provides:
 
@@ -73,10 +73,9 @@ def run(
 ) -> int:
 ```
 
-## How to Build, Test, and Lint
+## Commands
 
 ```bash
-# Create venv and install
 python3 -m venv .venv
 source .venv/bin/activate
 pip install ../mietzen-keepassxc-browser-api/   # local dependency
@@ -84,13 +83,15 @@ pip install -e ".[dev]"
 
 # Run tests
 pytest --tb=short -q
+
+# Run tests with coverage
 pytest --cov=keepassxc_cli --cov-report=term-missing
 
 # Lint
 ruff check --ignore=E501 --exclude=__init__.py ./keepassxc_cli
 ```
 
-## Key Conventions
+## Conventions
 
 - **`from __future__ import annotations`** must be the first line of every `.py` source file.
 - **Ruff**: `ruff check --ignore=E501 --exclude=__init__.py ./keepassxc_cli`
@@ -122,3 +123,10 @@ ruff check --ignore=E501 --exclude=__init__.py ./keepassxc_cli
 ## Output Formats
 
 Two formats are supported: `table` (default) and `json`. The `-j / --json` flag on individual subcommands or `default_format` in `cli.json` controls the default.
+
+## CI
+
+- `lint_and_test.yml` — Unit tests + ruff lint across Python 3.10–3.14
+- `pypi.yml` — Build & publish on release, then dispatch to homebrew-tap to update the formula
+- `auto-release.yml` — Auto-create patch release on dependabot merge
+- `auto-merge-dependabot.yml` — Auto-merge dependabot PRs

{keepassxc_cli-1.4.0/keepassxc_cli.egg-info → keepassxc_cli-1.6.0}/PKG-INFO

@@ -1,24 +1,22 @@
 Metadata-Version: 2.4
 Name: keepassxc-cli
-Version: 1.4.0
+Version: 1.6.0
 Summary: CLI for KeePassXC using the browser extension protocol with biometric unlock
 License-Expression: MIT
 Requires-Python: >=3.10
 Description-Content-Type: text/markdown
 License-File: LICENSE
-Requires-Dist: keepassxc-browser-api==1.3.0
+Requires-Dist: keepassxc-browser-api==1.4.0
 Requires-Dist: pyperclip==1.8.0
 Provides-Extra: dev
 Requires-Dist: pytest>=7.0; extra == "dev"
 Requires-Dist: pytest-cov>=4.0; extra == "dev"
 Dynamic: license-file
 
-# keepassxc-cli
+# KeePassXC CLI
 
 A command-line interface for [KeePassXC](https://keepassxc.org/) that communicates via the browser extension protocol, supporting biometric (TouchID/fingerprint) unlock on supported platforms.
 
-## What it is
-
 `keepassxc-cli` talks to a running KeePassXC instance using the same native messaging protocol used by the KeePassXC Browser extension. This means:
 
 - **Biometric unlock**: On macOS with TouchID (or similar) configured in KeePassXC, you can authenticate via fingerprint rather than typing your master password.
@@ -27,24 +25,32 @@ A command-line interface for [KeePassXC](https://keepassxc.org/) that communicat
 - **TOTP**: Retrieve time-based one-time passwords.
 - **Clipboard**: Copy credentials directly to the clipboard.
 
+![Functionality demonstration](assets/demo.gif)
+
+KeePassXC CLI based on [KeePassXC Browser API](https://github.com/mietzen/keepassxc-browser-api).
+
 ## Prerequisites
 
-1. **KeePassXC** ≥ 2.7 with the **Browser Integration** feature enabled:
-   - Open KeePassXC → Tools → Settings → Browser Integration
-   - Enable "Enable browser integration"
-2. A KeePassXC database must be open (or KeePassXC must be running with auto-open configured).
-3. Python ≥ 3.10
+- **macOS** (uses Unix sockets and KeePassXC's browser extension socket)
+- **Python >= 3.10**
+- **KeePassXC** with:
+  - Browser Integration enabled (Settings > Browser Integration > Enable browser integration)
+    ![KeePassXC Browser Integration Settings screenshot](assets/settings-browser-integration.png)
 
-## Installation
+## Install
 
-```bash
-pipx install keepassxc-cli
+### Homebrew (recommended)
+
+See **[homebrew homepage](https://brew.sh/)** on how to setup homebrew.
+
+```shell
+brew install mietzen/tap/keepassxc-cli
 ```
 
-Or with pip:
+### pipx
 
 ```bash
-pip install keepassxc-cli
+pipx install keepassxc-cli
 ```
 
 ## Setup
@@ -236,8 +242,11 @@ esac
 
 ## Development
 
+This package depends on [`keepassxc-browser-api`](https://github.com/mietzen/keepassxc-browser-api), which handles the KeePassXC browser extension protocol. The browser API credentials are stored in `~/.keepassxc/browser-api.json` and are shared with `keepassxc-ssh-agent` if installed.
+
 ```bash
 git clone https://github.com/mietzen/keepassxc-cli
+git clone https://github.com/mietzen/keepassxc-browser-api
 cd keepassxc-cli
 
 python3 -m venv .venv
@@ -252,7 +261,10 @@ pip install -e ".[dev]"
 # Run tests
 pytest --tb=short -q
 
-# Run linter
+# Run tests with coverage
+pytest --cov=keepassxc_cli --cov-report=term-missing
+
+# Lint
 ruff check --ignore=E501 --exclude=__init__.py ./keepassxc_cli
 ```
 

{keepassxc_cli-1.4.0 → keepassxc_cli-1.6.0}/README.md

@@ -1,9 +1,7 @@
-# keepassxc-cli
+# KeePassXC CLI
 
 A command-line interface for [KeePassXC](https://keepassxc.org/) that communicates via the browser extension protocol, supporting biometric (TouchID/fingerprint) unlock on supported platforms.
 
-## What it is
-
 `keepassxc-cli` talks to a running KeePassXC instance using the same native messaging protocol used by the KeePassXC Browser extension. This means:
 
 - **Biometric unlock**: On macOS with TouchID (or similar) configured in KeePassXC, you can authenticate via fingerprint rather than typing your master password.
@@ -12,24 +10,32 @@ A command-line interface for [KeePassXC](https://keepassxc.org/) that communicat
 - **TOTP**: Retrieve time-based one-time passwords.
 - **Clipboard**: Copy credentials directly to the clipboard.
 
+![Functionality demonstration](assets/demo.gif)
+
+KeePassXC CLI based on [KeePassXC Browser API](https://github.com/mietzen/keepassxc-browser-api).
+
 ## Prerequisites
 
-1. **KeePassXC** ≥ 2.7 with the **Browser Integration** feature enabled:
-   - Open KeePassXC → Tools → Settings → Browser Integration
-   - Enable "Enable browser integration"
-2. A KeePassXC database must be open (or KeePassXC must be running with auto-open configured).
-3. Python ≥ 3.10
+- **macOS** (uses Unix sockets and KeePassXC's browser extension socket)
+- **Python >= 3.10**
+- **KeePassXC** with:
+  - Browser Integration enabled (Settings > Browser Integration > Enable browser integration)
+    ![KeePassXC Browser Integration Settings screenshot](assets/settings-browser-integration.png)
 
-## Installation
+## Install
 
-```bash
-pipx install keepassxc-cli
+### Homebrew (recommended)
+
+See **[homebrew homepage](https://brew.sh/)** on how to setup homebrew.
+
+```shell
+brew install mietzen/tap/keepassxc-cli
 ```
 
-Or with pip:
+### pipx
 
 ```bash
-pip install keepassxc-cli
+pipx install keepassxc-cli
 ```
 
 ## Setup
@@ -221,8 +227,11 @@ esac
 
 ## Development
 
+This package depends on [`keepassxc-browser-api`](https://github.com/mietzen/keepassxc-browser-api), which handles the KeePassXC browser extension protocol. The browser API credentials are stored in `~/.keepassxc/browser-api.json` and are shared with `keepassxc-ssh-agent` if installed.
+
 ```bash
 git clone https://github.com/mietzen/keepassxc-cli
+git clone https://github.com/mietzen/keepassxc-browser-api
 cd keepassxc-cli
 
 python3 -m venv .venv
@@ -237,7 +246,10 @@ pip install -e ".[dev]"
 # Run tests
 pytest --tb=short -q
 
-# Run linter
+# Run tests with coverage
+pytest --cov=keepassxc_cli --cov-report=term-missing
+
+# Lint
 ruff check --ignore=E501 --exclude=__init__.py ./keepassxc_cli
 ```
 

{keepassxc_cli-1.4.0 → keepassxc_cli-1.6.0}/keepassxc_cli/commands/add.py

@@ -17,7 +17,9 @@ def add_parser(subparsers: argparse._SubParsersAction) -> None:
     p.add_argument("--url", required=True, help="Entry URL")
     p.add_argument("--username", required=True, help="Username")
     p.add_argument("--password", default=None, help="Password (prompted if omitted)")
-    p.add_argument("--group-uuid", default="", help="Target group UUID")
+    group = p.add_mutually_exclusive_group()
+    group.add_argument("--group-uuid", default="", help="Target group UUID")
+    group.add_argument("--group", default=None, help="Target group path (e.g. 'Work/Projects')")
     p.set_defaults(func=run)
 
 
@@ -34,11 +36,27 @@ def run(
     if password is None:
         password = getpass.getpass("Password: ")
 
+    group_uuid = args.group_uuid
+
+    if args.group is not None:
+        groups = client.get_database_groups()
+        root = groups[0]
+        parts = args.group.split("/")
+        current = root.children
+        matched = None
+        for part in parts:
+            matched = next((g for g in current if g.name == part), None)
+            if matched is None:
+                logger.error("Group not found: %r", args.group)
+                return 1
+            current = matched.children
+        group_uuid = matched.uuid
+
     client.set_login(
         url=args.url,
         username=args.username,
         password=password,
-        group_uuid=args.group_uuid,
+        group_uuid=group_uuid,
     )
     print("Entry added successfully.")
     return 0

{keepassxc_cli-1.4.0 → keepassxc_cli-1.6.0}/keepassxc_cli/commands/edit.py

@@ -14,17 +14,16 @@ logger = logging.getLogger(__name__)
 def add_parser(subparsers: argparse._SubParsersAction) -> None:
     p = subparsers.add_parser(
         "edit",
-        help="Edit an existing entry by UUID",
+        help="Edit an existing entry",
         description=(
-            "Edit an existing entry. The UUID must be known (use 'show' to find it).\n"
-            "Provide --url so the entry can be resolved; omitted fields are left unchanged."
+            "Edit an existing entry. Provide --url to look up the entry; omitted fields are\n"
+            "left unchanged. If the URL matches multiple entries, specify --uuid to disambiguate."
         ),
     )
-    p.add_argument("uuid", help="UUID of the entry to edit")
-    p.add_argument("--url", required=True, help="URL of the entry (used to resolve current values)")
+    p.add_argument("--url", required=True, help="URL of the entry")
+    p.add_argument("--uuid", default=None, help="UUID of the entry (required when URL matches multiple entries)")
     p.add_argument("--username", default=None, help="New username")
     p.add_argument("--password", default=None, help="New password")
-    p.add_argument("--title", default=None, help="New title")
     p.set_defaults(func=run)
 
 
@@ -37,21 +36,35 @@ def run(
     *,
     fmt: str = "table",
 ) -> int:
-    # Resolve current entry values via get_logins (no special permission needed)
     entries = client.get_logins(args.url)
-    entry = next((e for e in entries if e.uuid == args.uuid), None)
-    if entry is None:
+
+    if not entries:
+        logger.error("No entries found for: %s", args.url)
+        return 1
+
+    if args.uuid is not None:
+        entry = next((e for e in entries if e.uuid == args.uuid), None)
+        if entry is None:
+            logger.error(
+                "Entry %s not found for URL: %s",
+                args.uuid, args.url,
+            )
+            return 1
+    elif len(entries) == 1:
+        entry = entries[0]
+    else:
         logger.error(
-            "Entry %s not found for URL: %s\nHint: use 'keepassxc-cli show <url>' to look up the UUID.",
-            args.uuid, args.url,
+            "Multiple entries found for %s — specify --uuid to disambiguate:",
+            args.url,
         )
+        for e in entries:
+            print(f"  {e.uuid}  {e.login}  ({e.name})")
         return 1
 
     client.set_login(
         url=args.url,
         username=args.username if args.username is not None else entry.login,
         password=args.password if args.password is not None else entry.password,
-        title=args.title if args.title is not None else entry.name,
         uuid=entry.uuid,
         group_uuid=entry.group_uuid,
     )

keepassxc_cli-1.6.0/keepassxc_cli/commands/rm.py

@@ -0,0 +1,59 @@
+from __future__ import annotations
+
+import argparse
+import logging
+from pathlib import Path
+
+from keepassxc_browser_api import BrowserClient, BrowserConfig
+
+from keepassxc_cli.config import CliConfig
+
+logger = logging.getLogger(__name__)
+
+
+def add_parser(subparsers: argparse._SubParsersAction) -> None:
+    p = subparsers.add_parser("rm", help="Delete an entry")
+    group = p.add_mutually_exclusive_group(required=True)
+    group.add_argument("--uuid", default=None, help="UUID of the entry to delete")
+    group.add_argument("--url", default=None, help="URL of the entry to delete (must match exactly one entry)")
+    p.add_argument("-y", "--yes", action="store_true", help="Skip confirmation prompt")
+    p.set_defaults(func=run)
+
+
+def run(
+    client: BrowserClient,
+    args: argparse.Namespace,
+    cli_config: CliConfig,
+    browser_config: BrowserConfig,
+    browser_config_path: Path,
+    *,
+    fmt: str = "table",
+) -> int:
+    if args.uuid is not None:
+        target_uuid = args.uuid
+        label = args.uuid
+    else:
+        entries = client.get_logins(args.url)
+        if not entries:
+            logger.error("No entries found for: %s", args.url)
+            return 1
+        if len(entries) > 1:
+            logger.error(
+                "Multiple entries found for %s \u2014 specify --uuid to disambiguate:",
+                args.url,
+            )
+            for e in entries:
+                print(f"  {e.uuid}  {e.login}  ({e.name})")
+            return 1
+        target_uuid = entries[0].uuid
+        label = f"{entries[0].name} ({args.url})"
+
+    if not args.yes:
+        answer = input(f"Delete entry {label}? [y/N] ").strip().lower()
+        if answer != "y":
+            print("Aborted.")
+            return 1
+
+    client.delete_entry(target_uuid)
+    print("Entry deleted.")
+    return 0

{keepassxc_cli-1.4.0 → keepassxc_cli-1.6.0}/keepassxc_cli/config.py

@@ -1,13 +1,17 @@
 from __future__ import annotations
 
 import json
+import logging
 import os
+import stat
 from dataclasses import dataclass, field
 from pathlib import Path
 
 DEFAULT_BROWSER_API_CONFIG_PATH = str(Path.home() / ".keepassxc" / "browser-api.json")
 DEFAULT_CLI_CONFIG_PATH = Path.home() / ".keepassxc" / "cli.json"
 
+logger = logging.getLogger(__name__)
+
 
 @dataclass
 class CliConfig:
@@ -32,6 +36,7 @@ class CliConfig:
     def save(self, path: Path | str) -> None:
         path = Path(path)
         path.parent.mkdir(parents=True, exist_ok=True)
+        os.chmod(str(path.parent), stat.S_IRWXU)
         data = json.dumps(self.to_dict(), indent=2)
         # Write with restricted permissions (0o600)
         fd = os.open(path, os.O_WRONLY | os.O_CREAT | os.O_TRUNC, 0o600)
@@ -45,6 +50,13 @@ class CliConfig:
         path = Path(path)
         if not path.exists():
             return cls()
+        mode = path.stat().st_mode
+        if mode & 0o077:
+            logger.warning(
+                "Config file %s has insecure permissions %o; expected 0600. "
+                "Fix with: chmod 600 %s",
+                path, mode & 0o777, path,
+            )
         with open(path) as f:
             d = json.load(f)
         return cls.from_dict(d)

{keepassxc_cli-1.4.0 → keepassxc_cli-1.6.0/keepassxc_cli.egg-info}/PKG-INFO

@@ -1,24 +1,22 @@
 Metadata-Version: 2.4
 Name: keepassxc-cli
-Version: 1.4.0
+Version: 1.6.0
 Summary: CLI for KeePassXC using the browser extension protocol with biometric unlock
 License-Expression: MIT
 Requires-Python: >=3.10
 Description-Content-Type: text/markdown
 License-File: LICENSE
-Requires-Dist: keepassxc-browser-api==1.3.0
+Requires-Dist: keepassxc-browser-api==1.4.0
 Requires-Dist: pyperclip==1.8.0
 Provides-Extra: dev
 Requires-Dist: pytest>=7.0; extra == "dev"
 Requires-Dist: pytest-cov>=4.0; extra == "dev"
 Dynamic: license-file
 
-# keepassxc-cli
+# KeePassXC CLI
 
 A command-line interface for [KeePassXC](https://keepassxc.org/) that communicates via the browser extension protocol, supporting biometric (TouchID/fingerprint) unlock on supported platforms.
 
-## What it is
-
 `keepassxc-cli` talks to a running KeePassXC instance using the same native messaging protocol used by the KeePassXC Browser extension. This means:
 
 - **Biometric unlock**: On macOS with TouchID (or similar) configured in KeePassXC, you can authenticate via fingerprint rather than typing your master password.
@@ -27,24 +25,32 @@ A command-line interface for [KeePassXC](https://keepassxc.org/) that communicat
 - **TOTP**: Retrieve time-based one-time passwords.
 - **Clipboard**: Copy credentials directly to the clipboard.
 
+![Functionality demonstration](assets/demo.gif)
+
+KeePassXC CLI based on [KeePassXC Browser API](https://github.com/mietzen/keepassxc-browser-api).
+
 ## Prerequisites
 
-1. **KeePassXC** ≥ 2.7 with the **Browser Integration** feature enabled:
-   - Open KeePassXC → Tools → Settings → Browser Integration
-   - Enable "Enable browser integration"
-2. A KeePassXC database must be open (or KeePassXC must be running with auto-open configured).
-3. Python ≥ 3.10
+- **macOS** (uses Unix sockets and KeePassXC's browser extension socket)
+- **Python >= 3.10**
+- **KeePassXC** with:
+  - Browser Integration enabled (Settings > Browser Integration > Enable browser integration)
+    ![KeePassXC Browser Integration Settings screenshot](assets/settings-browser-integration.png)
 
-## Installation
+## Install
 
-```bash
-pipx install keepassxc-cli
+### Homebrew (recommended)
+
+See **[homebrew homepage](https://brew.sh/)** on how to setup homebrew.
+
+```shell
+brew install mietzen/tap/keepassxc-cli
 ```
 
-Or with pip:
+### pipx
 
 ```bash
-pip install keepassxc-cli
+pipx install keepassxc-cli
 ```
 
 ## Setup
@@ -236,8 +242,11 @@ esac
 
 ## Development
 
+This package depends on [`keepassxc-browser-api`](https://github.com/mietzen/keepassxc-browser-api), which handles the KeePassXC browser extension protocol. The browser API credentials are stored in `~/.keepassxc/browser-api.json` and are shared with `keepassxc-ssh-agent` if installed.
+
 ```bash
 git clone https://github.com/mietzen/keepassxc-cli
+git clone https://github.com/mietzen/keepassxc-browser-api
 cd keepassxc-cli
 
 python3 -m venv .venv
@@ -252,7 +261,10 @@ pip install -e ".[dev]"
 # Run tests
 pytest --tb=short -q
 
-# Run linter
+# Run tests with coverage
+pytest --cov=keepassxc_cli --cov-report=term-missing
+
+# Lint
 ruff check --ignore=E501 --exclude=__init__.py ./keepassxc_cli
 ```
 

{keepassxc_cli-1.4.0 → keepassxc_cli-1.6.0}/keepassxc_cli.egg-info/SOURCES.txt

@@ -7,6 +7,8 @@ pyproject.toml
 .github/workflows/auto-release.yml
 .github/workflows/lint_and_test.yml
 .github/workflows/pypi.yml
+assets/demo.gif
+assets/settings-browser-integration.png
 keepassxc_cli/__init__.py
 keepassxc_cli/__main__.py
 keepassxc_cli/config.py

{keepassxc_cli-1.4.0 → keepassxc_cli-1.6.0}/keepassxc_cli.egg-info/requires.txt

@@ -1,4 +1,4 @@
-keepassxc-browser-api==1.3.0
+keepassxc-browser-api==1.4.0
 pyperclip==1.8.0
 
 [dev]

{keepassxc_cli-1.4.0 → keepassxc_cli-1.6.0}/pyproject.toml

@@ -10,7 +10,7 @@ readme = "README.md"
 requires-python = ">=3.10"
 license = "MIT"
 dependencies = [
-    "keepassxc-browser-api==1.3.0",
+    "keepassxc-browser-api==1.4.0",
     "pyperclip==1.8.0",
 ]
 
@@ -32,3 +32,9 @@ local_scheme = "no-local-version"
 
 [tool.pytest.ini_options]
 testpaths = ["tests"]
+
+[tool.ruff]
+exclude = ["**/__init__.py"]
+
+[tool.ruff.lint]
+ignore = ["E501"]

{keepassxc_cli-1.4.0 → keepassxc_cli-1.6.0}/tests/test_commands.py

@@ -40,6 +40,7 @@ def make_args(**kwargs) -> argparse.Namespace:
         "username": "user",
         "password": "pass",
         "group_uuid": "",
+        "group": None,
         "uuid": "abcdef12-0000-0000-0000-000000000000",
         "name": "NewGroup",
         "path": "Work",
@@ -141,15 +142,36 @@ class TestShowCommand:
 class TestAddCommand:
     def test_success(self, mock_client, cli_config, browser_config, browser_config_path, capsys):
         mock_client.set_login.return_value = True
-        args = make_args(url="https://example.com", username="u", password="p", group_uuid="")
+        args = make_args(url="https://example.com", username="u", password="p", group_uuid="", group=None)
         rc = add.run(mock_client, args, cli_config, browser_config, browser_config_path)
         assert rc == 0
         mock_client.set_login.assert_called_once()
         assert "added" in capsys.readouterr().out.lower()
 
+    def test_group_path_resolved(self, mock_client, cli_config, browser_config, browser_config_path, capsys, mock_group):
+        from keepassxc_browser_api import Group
+        projects = mock_group(uuid="proj-uuid", name="Projects")
+        work = mock_group(uuid="work-uuid", name="Work", children=[projects])
+        root = mock_group(uuid="root-uuid", name="Root", children=[work])
+        mock_client.get_database_groups.return_value = [root]
+        mock_client.set_login.return_value = True
+        args = make_args(url="https://example.com", username="u", password="p", group_uuid="", group="Work/Projects")
+        rc = add.run(mock_client, args, cli_config, browser_config, browser_config_path)
+        assert rc == 0
+        call_kwargs = mock_client.set_login.call_args.kwargs
+        assert call_kwargs["group_uuid"] == "proj-uuid"
+
+    def test_group_path_not_found(self, mock_client, cli_config, browser_config, browser_config_path, caplog, mock_group):
+        root = mock_group(uuid="root-uuid", name="Root", children=[])
+        mock_client.get_database_groups.return_value = [root]
+        args = make_args(url="https://example.com", username="u", password="p", group_uuid="", group="NonExistent")
+        rc = add.run(mock_client, args, cli_config, browser_config, browser_config_path)
+        assert rc == 1
+        assert any("not found" in r.message.lower() for r in caplog.records)
+
     def test_failure_propagates(self, mock_client, cli_config, browser_config, browser_config_path):
         mock_client.set_login.side_effect = ProtocolError("access denied", error_code=6)
-        args = make_args(url="https://example.com", username="u", password="p", group_uuid="")
+        args = make_args(url="https://example.com", username="u", password="p", group_uuid="", group=None)
         with pytest.raises(ProtocolError):
             add.run(mock_client, args, cli_config, browser_config, browser_config_path)
 
@@ -157,37 +179,91 @@ class TestAddCommand:
 # --- edit ---
 
 class TestEditCommand:
-    def test_entry_found_and_updated(self, mock_client, cli_config, browser_config, browser_config_path, capsys, mock_entry):
+    def test_uuid_specified_and_updated(self, mock_client, cli_config, browser_config, browser_config_path, capsys, mock_entry):
         entry = mock_entry()
         mock_client.get_logins.return_value = [entry]
         mock_client.set_login.return_value = True
-        args = make_args(uuid=entry.uuid, url="https://example.com", username="newuser", password=None, title=None)
+        args = make_args(uuid=entry.uuid, url="https://example.com", username="newuser", password=None)
         rc = edit.run(mock_client, args, cli_config, browser_config, browser_config_path)
         assert rc == 0
         assert "updated" in capsys.readouterr().out.lower()
+        mock_client.set_login.assert_called_once()
+        call_kwargs = mock_client.set_login.call_args.kwargs
+        assert "title" not in call_kwargs
 
-    def test_entry_not_found(self, mock_client, cli_config, browser_config, browser_config_path, caplog):
-        mock_client.get_logins.return_value = []
-        args = make_args(uuid="nonexistent-uuid", url="https://example.com", username=None, password=None, title=None)
+    def test_no_uuid_single_match_auto_selected(self, mock_client, cli_config, browser_config, browser_config_path, capsys, mock_entry):
+        entry = mock_entry()
+        mock_client.get_logins.return_value = [entry]
+        mock_client.set_login.return_value = True
+        args = make_args(uuid=None, url="https://example.com", username="newuser", password=None)
+        rc = edit.run(mock_client, args, cli_config, browser_config, browser_config_path)
+        assert rc == 0
+        assert "updated" in capsys.readouterr().out.lower()
+
+    def test_no_uuid_multiple_matches_error(self, mock_client, cli_config, browser_config, browser_config_path, caplog, mock_entry):
+        e1 = mock_entry(uuid="uuid-1", login="alice")
+        e2 = mock_entry(uuid="uuid-2", login="bob")
+        mock_client.get_logins.return_value = [e1, e2]
+        args = make_args(uuid=None, url="https://example.com", username="newuser", password=None)
+        rc = edit.run(mock_client, args, cli_config, browser_config, browser_config_path)
+        assert rc == 1
+        assert any("multiple" in r.message.lower() for r in caplog.records)
+
+    def test_uuid_not_in_results(self, mock_client, cli_config, browser_config, browser_config_path, caplog, mock_entry):
+        entry = mock_entry()
+        mock_client.get_logins.return_value = [entry]
+        args = make_args(uuid="nonexistent-uuid", url="https://example.com", username=None, password=None)
         rc = edit.run(mock_client, args, cli_config, browser_config, browser_config_path)
         assert rc == 1
         assert any("not found" in r.message.lower() for r in caplog.records)
 
+    def test_no_entries_found(self, mock_client, cli_config, browser_config, browser_config_path, caplog):
+        mock_client.get_logins.return_value = []
+        args = make_args(uuid=None, url="https://example.com", username=None, password=None)
+        rc = edit.run(mock_client, args, cli_config, browser_config, browser_config_path)
+        assert rc == 1
+        assert any("no entries" in r.message.lower() for r in caplog.records)
+
 
 # --- rm ---
 
 class TestRmCommand:
-    def test_with_yes_flag(self, mock_client, cli_config, browser_config, browser_config_path, capsys):
+    def test_uuid_with_yes_flag(self, mock_client, cli_config, browser_config, browser_config_path, capsys):
         mock_client.delete_entry.return_value = True
-        args = make_args(uuid="some-uuid", yes=True)
+        args = make_args(uuid="some-uuid", url=None, yes=True)
         rc = rm.run(mock_client, args, cli_config, browser_config, browser_config_path)
         assert rc == 0
         mock_client.delete_entry.assert_called_once_with("some-uuid")
         assert "deleted" in capsys.readouterr().out.lower()
 
+    def test_url_single_match_deletes(self, mock_client, cli_config, browser_config, browser_config_path, capsys, mock_entry):
+        entry = mock_entry(uuid="url-resolved-uuid")
+        mock_client.get_logins.return_value = [entry]
+        mock_client.delete_entry.return_value = True
+        args = make_args(uuid=None, url="https://example.com", yes=True)
+        rc = rm.run(mock_client, args, cli_config, browser_config, browser_config_path)
+        assert rc == 0
+        mock_client.delete_entry.assert_called_once_with("url-resolved-uuid")
+
+    def test_url_multiple_matches_error(self, mock_client, cli_config, browser_config, browser_config_path, caplog, mock_entry):
+        e1 = mock_entry(uuid="uuid-1", login="alice")
+        e2 = mock_entry(uuid="uuid-2", login="bob")
+        mock_client.get_logins.return_value = [e1, e2]
+        args = make_args(uuid=None, url="https://example.com", yes=True)
+        rc = rm.run(mock_client, args, cli_config, browser_config, browser_config_path)
+        assert rc == 1
+        assert any("multiple" in r.message.lower() for r in caplog.records)
+
+    def test_url_no_entries_error(self, mock_client, cli_config, browser_config, browser_config_path, caplog):
+        mock_client.get_logins.return_value = []
+        args = make_args(uuid=None, url="https://notfound.com", yes=True)
+        rc = rm.run(mock_client, args, cli_config, browser_config, browser_config_path)
+        assert rc == 1
+        assert any("no entries" in r.message.lower() for r in caplog.records)
+
     def test_failure_propagates(self, mock_client, cli_config, browser_config, browser_config_path):
         mock_client.delete_entry.side_effect = ProtocolError("access denied", error_code=6)
-        args = make_args(uuid="some-uuid", yes=True)
+        args = make_args(uuid="some-uuid", url=None, yes=True)
         with pytest.raises(ProtocolError):
             rm.run(mock_client, args, cli_config, browser_config, browser_config_path)
 

keepassxc_cli-1.4.0/keepassxc_cli/commands/rm.py

@@ -1,38 +0,0 @@
-from __future__ import annotations
-
-import argparse
-import logging
-from pathlib import Path
-
-from keepassxc_browser_api import BrowserClient, BrowserConfig
-
-from keepassxc_cli.config import CliConfig
-
-logger = logging.getLogger(__name__)
-
-
-def add_parser(subparsers: argparse._SubParsersAction) -> None:
-    p = subparsers.add_parser("rm", help="Delete an entry by UUID")
-    p.add_argument("uuid", help="UUID of the entry to delete")
-    p.add_argument("-y", "--yes", action="store_true", help="Skip confirmation prompt")
-    p.set_defaults(func=run)
-
-
-def run(
-    client: BrowserClient,
-    args: argparse.Namespace,
-    cli_config: CliConfig,
-    browser_config: BrowserConfig,
-    browser_config_path: Path,
-    *,
-    fmt: str = "table",
-) -> int:
-    if not args.yes:
-        answer = input(f"Delete entry {args.uuid}? [y/N] ").strip().lower()
-        if answer != "y":
-            print("Aborted.")
-            return 1
-
-    client.delete_entry(args.uuid)
-    print("Entry deleted.")
-    return 0