timo-otp 1.0.1__tar.gz

timo_otp-1.0.1/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2025 Leonardo
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

timo_otp-1.0.1/PKG-INFO

@@ -0,0 +1,149 @@
+Metadata-Version: 2.4
+Name: timo-otp
+Version: 1.0.1
+Summary: Your authenticator app, in the terminal, one word away: an encrypted TOTP manager with fzf, QR import and export
+Author: Leonardo Martignoni
+License-Expression: MIT
+Project-URL: Source, https://github.com/leomarss/timo
+Project-URL: Issues, https://github.com/leomarss/timo/issues
+Project-URL: Changelog, https://github.com/leomarss/timo/blob/main/CHANGELOG.md
+Keywords: 2fa,totp,otp,authenticator,cli,terminal,fzf,google-authenticator
+Classifier: Development Status :: 5 - Production/Stable
+Classifier: Environment :: Console
+Classifier: Intended Audience :: End Users/Desktop
+Classifier: Operating System :: MacOS
+Classifier: Operating System :: POSIX :: Linux
+Classifier: Programming Language :: Python :: 3
+Classifier: Topic :: Security
+Classifier: Topic :: Security :: Cryptography
+Classifier: Topic :: Utilities
+Requires-Python: >=3.9
+Description-Content-Type: text/markdown
+License-File: LICENSE
+Requires-Dist: cryptography>=42
+Requires-Dist: keyring>=25
+Requires-Dist: protobuf<7,>=4.21
+Requires-Dist: pyotp>=2.9
+Requires-Dist: pyperclip>=1.9
+Requires-Dist: segno>=1.5
+Provides-Extra: dev
+Requires-Dist: pytest>=8; extra == "dev"
+Provides-Extra: webcam
+Requires-Dist: av>=14; extra == "webcam"
+Requires-Dist: zxing-cpp>=2.3; extra == "webcam"
+Dynamic: license-file
+
+<h1 align="center">
+  <picture>
+    <source media="(prefers-color-scheme: light)" srcset="https://raw.githubusercontent.com/leomarss/timo/main/assets/banner-light.png">
+    <img src="https://raw.githubusercontent.com/leomarss/timo/main/assets/banner.png" width="100%" alt="timo: encrypted at rest, no phone needed, no network. Fast, encrypted, import from Google Authenticator or any QR, export to any other app">
+  </picture>
+</h1>
+
+<p align="center">
+  <b>Your authenticator app, in the terminal, one word away.</b><br>
+  <sub><i>Time-based Identity Manager for OTPs</i></sub>
+</p>
+
+<p align="center">
+  <img alt="Python 3.9+" src="https://img.shields.io/badge/python-3.9%2B-4f8cff?style=flat-square&logo=python&logoColor=white&labelColor=0f1626">
+  <img alt="macOS · Linux" src="https://img.shields.io/badge/macOS%20%C2%B7%20Linux-supported-4f8cff?style=flat-square&labelColor=0f1626">
+  <a href="https://github.com/leomarss/timo/releases"><img alt="Release" src="https://img.shields.io/github/v/release/leomarss/timo?style=flat-square&color=4f8cff&labelColor=0f1626&label=release"></a>
+  <a href="https://github.com/leomarss/timo/blob/main/LICENSE"><img alt="License: MIT" src="https://img.shields.io/badge/license-MIT-4f8cff?style=flat-square&labelColor=0f1626"></a>
+</p>
+
+<p align="center">
+  <a href="#demo">Demo</a> ·
+  <a href="#install">Install</a> ·
+  <a href="#usage">Usage</a> ·
+  <a href="#security">Security</a> ·
+  <a href="#development">Development</a>
+</p>
+
+<br>
+
+## Demo
+<p align="center">
+  <picture>
+    <source media="(prefers-color-scheme: light)" srcset="https://raw.githubusercontent.com/leomarss/timo/main/assets/demo-light.gif">
+    <img src="https://raw.githubusercontent.com/leomarss/timo/main/assets/demo.gif" width="100%" alt="timo google copies a code, then timo opens the fzf picker to find and copy Cloudflare">
+  </picture>
+</p>
+
+<br>
+
+Type a word, get the code on your clipboard. No phone, no app switching. Pick from a fuzzy list with `fzf` when you're not sure, import everything from Google Authenticator in one go, and take it all with you when you leave.
+
+- **One word, one code**: copied to your clipboard, cleared after 45s
+- **Encrypted at rest**: scrypt + AES-256-GCM, passphrase in your OS keychain
+- **Bring your accounts**: Google Authenticator export or any 2FA setup QR, via image, webcam or link
+- **Take them with you**: export as setup QR codes or `otpauth://` links to any other app
+
+<br>
+
+## Install
+
+```bash
+brew install pipx fzf               # Debian/Ubuntu: sudo apt install pipx fzf
+pipx install timo-otp
+
+# Optional: scan QR codes from images and with the webcam
+brew install zbar                   # Debian/Ubuntu: sudo apt install zbar-tools
+pipx inject timo-otp av zxing-cpp
+```
+
+Update with `pipx upgrade timo-otp`.
+
+<br>
+
+## Usage
+
+```bash
+timo --initialize    # import a Google Authenticator export (first run sets your passphrase)
+timo --add           # add one account from a setup QR, otpauth:// link or secret key
+timo github          # copy the code of the account matching "github"
+timo                 # pick an account with fzf
+```
+
+| Command | What it does |
+|---|---|
+| `timo WORDS` | Copy the code of the matching account (`--no-copy` to just print it) |
+| `--list` · `--stats` | List accounts, or count them per issuer |
+| `--watch` | Show every code, live |
+| `--add` · `--remove` · `--edit` | Manage single accounts |
+| `--export [WORDS]` | Move accounts to another app (`--format uri` for links) |
+| `--backup` · `--restore NAME` | Encrypted backups, made automatically before every change |
+| `--passwd` · `--forget` | Change the passphrase, or drop it from the keychain |
+
+Run `timo --help` for the full list. Plain words are always a search, so an account can be called `edit` or `list`.
+
+> [!WARNING]
+> Your passphrase encrypts everything. **If you forget it, the secrets cannot be recovered**, so keep your original export somewhere safe.
+
+<br>
+
+## Security
+
+- 🗝️ Secrets live in `~/.config/timo/secrets.enc` (override with `TIMO_HOME`), with `700`/`600` permissions and crash-safe writes.
+- The `fzf` preview never sees your secrets or passphrase, only the next 10 minutes of codes.
+- `--edit` temp files are deleted, webcam frames stay in memory, and export QR codes are cleared from scrollback.
+- Exported `otpauth://` links are **not** encrypted: delete them once imported.
+- No `sudo`, no network.
+
+<br>
+
+## Development
+
+```bash
+python3 -m venv env
+env/bin/pip install -e '.[dev]'
+env/bin/python -m pytest
+```
+
+See [CONTRIBUTING.md](https://github.com/leomarss/timo/blob/main/CONTRIBUTING.md) before opening a pull request, and [SECURITY.md](https://github.com/leomarss/timo/blob/main/SECURITY.md) to report a vulnerability.
+
+<br>
+
+## License
+
+MIT. Built on [fzf](https://github.com/junegunn/fzf), [zbar](https://github.com/mchehab/zbar), [PyAV](https://github.com/PyAV-Org/PyAV) and [zxing-cpp](https://github.com/zxing-cpp/zxing-cpp).

timo_otp-1.0.1/README.md

@@ -0,0 +1,114 @@
+<h1 align="center">
+  <picture>
+    <source media="(prefers-color-scheme: light)" srcset="https://raw.githubusercontent.com/leomarss/timo/main/assets/banner-light.png">
+    <img src="https://raw.githubusercontent.com/leomarss/timo/main/assets/banner.png" width="100%" alt="timo: encrypted at rest, no phone needed, no network. Fast, encrypted, import from Google Authenticator or any QR, export to any other app">
+  </picture>
+</h1>
+
+<p align="center">
+  <b>Your authenticator app, in the terminal, one word away.</b><br>
+  <sub><i>Time-based Identity Manager for OTPs</i></sub>
+</p>
+
+<p align="center">
+  <img alt="Python 3.9+" src="https://img.shields.io/badge/python-3.9%2B-4f8cff?style=flat-square&logo=python&logoColor=white&labelColor=0f1626">
+  <img alt="macOS · Linux" src="https://img.shields.io/badge/macOS%20%C2%B7%20Linux-supported-4f8cff?style=flat-square&labelColor=0f1626">
+  <a href="https://github.com/leomarss/timo/releases"><img alt="Release" src="https://img.shields.io/github/v/release/leomarss/timo?style=flat-square&color=4f8cff&labelColor=0f1626&label=release"></a>
+  <a href="https://github.com/leomarss/timo/blob/main/LICENSE"><img alt="License: MIT" src="https://img.shields.io/badge/license-MIT-4f8cff?style=flat-square&labelColor=0f1626"></a>
+</p>
+
+<p align="center">
+  <a href="#demo">Demo</a> ·
+  <a href="#install">Install</a> ·
+  <a href="#usage">Usage</a> ·
+  <a href="#security">Security</a> ·
+  <a href="#development">Development</a>
+</p>
+
+<br>
+
+## Demo
+<p align="center">
+  <picture>
+    <source media="(prefers-color-scheme: light)" srcset="https://raw.githubusercontent.com/leomarss/timo/main/assets/demo-light.gif">
+    <img src="https://raw.githubusercontent.com/leomarss/timo/main/assets/demo.gif" width="100%" alt="timo google copies a code, then timo opens the fzf picker to find and copy Cloudflare">
+  </picture>
+</p>
+
+<br>
+
+Type a word, get the code on your clipboard. No phone, no app switching. Pick from a fuzzy list with `fzf` when you're not sure, import everything from Google Authenticator in one go, and take it all with you when you leave.
+
+- **One word, one code**: copied to your clipboard, cleared after 45s
+- **Encrypted at rest**: scrypt + AES-256-GCM, passphrase in your OS keychain
+- **Bring your accounts**: Google Authenticator export or any 2FA setup QR, via image, webcam or link
+- **Take them with you**: export as setup QR codes or `otpauth://` links to any other app
+
+<br>
+
+## Install
+
+```bash
+brew install pipx fzf               # Debian/Ubuntu: sudo apt install pipx fzf
+pipx install timo-otp
+
+# Optional: scan QR codes from images and with the webcam
+brew install zbar                   # Debian/Ubuntu: sudo apt install zbar-tools
+pipx inject timo-otp av zxing-cpp
+```
+
+Update with `pipx upgrade timo-otp`.
+
+<br>
+
+## Usage
+
+```bash
+timo --initialize    # import a Google Authenticator export (first run sets your passphrase)
+timo --add           # add one account from a setup QR, otpauth:// link or secret key
+timo github          # copy the code of the account matching "github"
+timo                 # pick an account with fzf
+```
+
+| Command | What it does |
+|---|---|
+| `timo WORDS` | Copy the code of the matching account (`--no-copy` to just print it) |
+| `--list` · `--stats` | List accounts, or count them per issuer |
+| `--watch` | Show every code, live |
+| `--add` · `--remove` · `--edit` | Manage single accounts |
+| `--export [WORDS]` | Move accounts to another app (`--format uri` for links) |
+| `--backup` · `--restore NAME` | Encrypted backups, made automatically before every change |
+| `--passwd` · `--forget` | Change the passphrase, or drop it from the keychain |
+
+Run `timo --help` for the full list. Plain words are always a search, so an account can be called `edit` or `list`.
+
+> [!WARNING]
+> Your passphrase encrypts everything. **If you forget it, the secrets cannot be recovered**, so keep your original export somewhere safe.
+
+<br>
+
+## Security
+
+- 🗝️ Secrets live in `~/.config/timo/secrets.enc` (override with `TIMO_HOME`), with `700`/`600` permissions and crash-safe writes.
+- The `fzf` preview never sees your secrets or passphrase, only the next 10 minutes of codes.
+- `--edit` temp files are deleted, webcam frames stay in memory, and export QR codes are cleared from scrollback.
+- Exported `otpauth://` links are **not** encrypted: delete them once imported.
+- No `sudo`, no network.
+
+<br>
+
+## Development
+
+```bash
+python3 -m venv env
+env/bin/pip install -e '.[dev]'
+env/bin/python -m pytest
+```
+
+See [CONTRIBUTING.md](https://github.com/leomarss/timo/blob/main/CONTRIBUTING.md) before opening a pull request, and [SECURITY.md](https://github.com/leomarss/timo/blob/main/SECURITY.md) to report a vulnerability.
+
+<br>
+
+## License
+
+MIT. Built on [fzf](https://github.com/junegunn/fzf), [zbar](https://github.com/mchehab/zbar), [PyAV](https://github.com/PyAV-Org/PyAV) and [zxing-cpp](https://github.com/zxing-cpp/zxing-cpp).

timo_otp-1.0.1/pyproject.toml

@@ -0,0 +1,57 @@
+[build-system]
+requires = ["setuptools>=77"]
+build-backend = "setuptools.build_meta"
+
+[project]
+name = "timo-otp"
+description = "Your authenticator app, in the terminal, one word away: an encrypted TOTP manager with fzf, QR import and export"
+readme = "README.md"
+license = "MIT"
+license-files = ["LICENSE"]
+requires-python = ">=3.9"
+authors = [{ name = "Leonardo Martignoni" }]
+keywords = ["2fa", "totp", "otp", "authenticator", "cli", "terminal", "fzf", "google-authenticator"]
+classifiers = [
+    "Development Status :: 5 - Production/Stable",
+    "Environment :: Console",
+    "Intended Audience :: End Users/Desktop",
+    "Operating System :: MacOS",
+    "Operating System :: POSIX :: Linux",
+    "Programming Language :: Python :: 3",
+    "Topic :: Security",
+    "Topic :: Security :: Cryptography",
+    "Topic :: Utilities",
+]
+dynamic = ["version"]
+dependencies = [
+    "cryptography>=42",
+    "keyring>=25",
+    "protobuf>=4.21,<7",
+    "pyotp>=2.9",
+    "pyperclip>=1.9",
+    "segno>=1.5",
+]
+
+[project.optional-dependencies]
+dev = ["pytest>=8"]
+webcam = ["av>=14", "zxing-cpp>=2.3"]
+
+[project.scripts]
+timo = "timo.cli:main"
+
+[project.urls]
+Source = "https://github.com/leomarss/timo"
+Issues = "https://github.com/leomarss/timo/issues"
+Changelog = "https://github.com/leomarss/timo/blob/main/CHANGELOG.md"
+
+[tool.setuptools.dynamic]
+version = {attr = "timo.__version__"}
+
+[tool.setuptools.packages.find]
+where = ["src"]
+
+[tool.setuptools.package-data]
+"timo.protobuf" = ["migration.proto"]
+
+[tool.pytest.ini_options]
+testpaths = ["tests"]

timo_otp-1.0.1/setup.cfg

@@ -0,0 +1,4 @@
+[egg_info]
+tag_build = 
+tag_date = 0
+

timo_otp-1.0.1/src/timo/__init__.py

@@ -0,0 +1,3 @@
+"""timo - Time-based Identity Manager for OTPs."""
+
+__version__ = "1.0.1"

timo_otp-1.0.1/src/timo/__main__.py

@@ -0,0 +1,5 @@
+import sys
+
+from timo.cli import main
+
+sys.exit(main())

timo_otp-1.0.1/src/timo/cli.py

@@ -0,0 +1,245 @@
+"""Command-line entry point.
+
+Every option starts with '-' or '--'; plain words are always a search, so an
+account can be called "edit" or "list" without clashing with a command.
+"""
+import argparse
+import os
+import sys
+
+from timo import __version__, commands, ui
+from timo import messages as msg
+from timo.commands import Abort, Context
+
+PACKAGE_DIR = os.path.dirname(os.path.abspath(__file__))
+
+INTRO = "timo · your authenticator app, in the terminal, one word away"
+FOOTER = (
+    "Secrets live in ~/.config/timo/ (set TIMO_HOME to use another folder).",
+    "Set TIMO_CLEAR_AFTER to change the default of --clear-after.",
+    'To search for a word that starts with "-": timo -- -word',
+)
+
+EXPORT_FORMATS = ("setup-qr", "uri")
+
+# action name -> (flag, handler)
+ACTIONS = {
+    "list": ("--list", commands.cmd_list),
+    "stats": ("--stats", commands.cmd_stats),
+    "watch": ("--watch", commands.cmd_watch),
+    "edit": ("--edit", commands.cmd_edit),
+    "initialize": ("--initialize", commands.cmd_import),
+    "export": ("--export", commands.cmd_export),
+    "add": ("--add", commands.cmd_add),
+    "passwd": ("--passwd", commands.cmd_passwd),
+    "forget": ("--forget", commands.cmd_forget),
+    "remember": ("--remember", commands.cmd_remember),
+    "list-backups": ("--list-backups", commands.cmd_backup_list),
+    "restore": ("--restore", commands.cmd_backup_restore),
+    "remove": ("--remove", commands.cmd_remove),
+    "remove-backups": ("--remove-backups", commands.cmd_backup_remove),
+    "remove-all-backups": ("--remove-all-backups", commands.cmd_backup_remove_all),
+    "backup": ("--backup", commands.cmd_backup_create),
+    "get": (None, commands.cmd_get),
+}
+
+
+def config_dir():
+    if os.environ.get("TIMO_HOME"):
+        return os.environ["TIMO_HOME"]
+    base = os.environ.get("XDG_CONFIG_HOME") or os.path.join(os.path.expanduser("~"), ".config")
+    return os.path.join(base, "timo")
+
+
+def make_context():
+    home = config_dir()
+    return Context(
+        secrets_path=os.path.join(home, "secrets.enc"),
+        backup_dir=os.path.join(home, "backups"),
+        python_path=sys.executable,
+        preview_script=os.path.join(PACKAGE_DIR, "preview.py"),
+    )
+
+
+def _seconds(value):
+    try:
+        seconds = int(value)
+    except ValueError:
+        seconds = -1
+    if seconds < 0:
+        raise argparse.ArgumentTypeError("must be a whole number of seconds (0 = never clear)")
+    return seconds
+
+
+class Parser(argparse.ArgumentParser):
+    """An ArgumentParser whose --help is grouped by task.
+
+    The help is generated from the add_argument() calls: flag names and
+    placeholders come from each action, descriptions from its help=. Only the
+    section titles, INTRO and FOOTER are written by hand. Options that only
+    work with one action are listed indented under it.
+    """
+
+    def __init__(self, *args, **kwargs):
+        super().__init__(*args, **kwargs)
+        self.sections = []  # [(title, [(action, help, indented)])]
+
+    def section(self, title):
+        self.sections.append((title, []))
+
+    def option(self, *flags, under=None, **kwargs):
+        """add_argument(), and list it in the current section (indented if `under` an action)."""
+        action = self.add_argument(*flags, **kwargs)
+        self.show(action, under=under)
+        return action
+
+    def show(self, action, help=None, under=None):
+        """List an action (again) in the current section, e.g. --backup under --edit."""
+        self.sections[-1][1].append((action, help or action.help, under is not None))
+
+    def format_help(self):
+        rows = [(title, [(_invocation(action), text, indented) for action, text, indented in entries])
+                for title, entries in self.sections]
+        width = max(len(name) + len(meta) + (4 if indented else 0)
+                    for _, entries in rows for (name, meta), _, indented in entries)
+        lines = [ui.paint(INTRO, ui.BOLD), ""]
+        for title, entries in rows:
+            lines.append(ui.paint(title, ui.BOLD))
+            for (name, meta), text, indented in entries:
+                indent = "      " if indented else "  "
+                gap = " " * (width - len(name) - len(meta) - len(indent) + 5)
+                shown = ui.paint(name, ui.CYAN) + (ui.paint(meta, ui.DIM) if meta else "")
+                lines.append(f"{indent}{shown}{gap}{text}")
+            lines.append("")
+        lines += [ui.paint(line, ui.DIM) for line in FOOTER]
+        return "\n".join(lines) + "\n"
+
+
+def _invocation(action):
+    """("--restore", " NAME"): how an action is typed, split into name and placeholder."""
+    if not action.option_strings:
+        return "timo", f" [{action.metavar}...]"
+    name = ", ".join(sorted(action.option_strings, key=len, reverse=True))
+    if action.nargs == 0:
+        return name, ""
+    metavar = action.metavar or action.dest.upper()
+    return name, f" {metavar}..." if action.nargs == "+" else f" {metavar}"
+
+
+def build_parser():
+    parser = Parser(
+        prog="timo",
+        usage="timo [WORDS...] [--no-copy] [--clear-after SECONDS]\n       timo --<action> [options]",
+        add_help=False,  # -h is declared below, in its section
+        allow_abbrev=False,  # flags must be spelled out: --lis is not --list
+    )
+    option = parser.option
+
+    parser.section("Copy a code")
+    words = option("query", nargs="*", metavar="WORDS",
+                   help="copy the code of the account matching all words (none: pick with fzf)")
+    option("--no-copy", action="store_true", under=words, help="print the code, don't copy it")
+    option("--clear-after", type=_seconds, metavar="SECONDS", under=words,
+           help="clear the clipboard after SECONDS, 0 = never (default 45)")
+
+    parser.section("See your accounts")
+    option("--list", action="store_true", help="list all accounts and the day each was added")
+    option("--stats", action="store_true", help="show account counts per issuer")
+    option("--watch", action="store_true", help="show all codes, refreshing every second")
+
+    parser.section("Add and change accounts")
+    option("--initialize", action="store_true", help="import a Google Authenticator export")
+    export = option("--export", action="store_true",
+                    help="export accounts matching WORDS (none: all) to another app")
+    option("--format", choices=EXPORT_FORMATS, metavar="FORMAT", under=export,
+           help="setup-qr: one QR code per account (default in a terminal), or uri")
+    option("--output", metavar="FILE", under=export, help="write otpauth:// links to FILE (readable only by you)")
+    option("--add", action="store_true", help="add one account (setup QR code, otpauth:// link or secret key)")
+    option("--remove", action="store_true", help="pick an account and remove it (asks first)")
+    edit = option("--edit", action="store_true", help="edit the decrypted accounts in your editor")
+    backup = option("--backup", action="store_true", under=edit, help="back up before saving the changes")
+    option("--editor", metavar="CMD", under=edit, help="editor to use (default: $EDITOR, then vi/nano/vim)")
+
+    parser.section("Backups")
+    parser.show(backup, help="create a backup")
+    option("--list-backups", action="store_true", help="show available backups")
+    option("--restore", metavar="NAME", help="restore a backup (current secrets are backed up first)")
+    option("--remove-backups", nargs="+", metavar="NAME", help="delete backups")
+    option("--remove-all-backups", action="store_true", help="delete all backups (asks first)")
+
+    parser.section("Passphrase")
+    option("--passwd", action="store_true", help="change the passphrase")
+    option("--forget", action="store_true", help="remove it from your keychain and stop saving it")
+    option("--remember", action="store_true", help="save it in your keychain again on the next unlock")
+
+    parser.section("Other")
+    option("--version", action="version", version=f"%(prog)s {__version__}", help="show the installed version")
+    option("-h", "--help", action="help", help="show this help")
+    return parser
+
+
+def _chosen_actions(args):
+    chosen = []
+    for name, (flag, _) in ACTIONS.items():
+        if flag is None:
+            continue
+        value = getattr(args, flag[2:].replace("-", "_"))
+        if value not in (None, False):
+            chosen.append(name)
+    # --backup is a modifier of --edit
+    if "backup" in chosen and "edit" in chosen:
+        chosen.remove("backup")
+    return chosen
+
+
+def parse(argv):
+    parser = build_parser()
+    # everything after "--" is a search word; intermixed parsing loses track of "--" itself
+    literal = []
+    if "--" in argv:
+        i = argv.index("--")
+        argv, literal = argv[:i], argv[i + 1:]
+    args = parser.parse_intermixed_args(argv)  # search words may come before and after options
+    args.query = args.query + literal
+    chosen = _chosen_actions(args)
+
+    if len(chosen) > 1:
+        parser.error("use only one of: " + ", ".join(ACTIONS[a][0] for a in chosen))
+    action = chosen[0] if chosen else "get"
+
+    if action != "get":
+        if args.query and action != "export":
+            parser.error(f"search words can't be combined with {ACTIONS[action][0]}")
+        if args.no_copy or args.clear_after is not None:
+            parser.error("--no-copy and --clear-after only apply when copying a code")
+    if args.editor is not None and action != "edit":
+        parser.error("--editor only works with --edit")
+    if (args.format is not None or args.output is not None) and action != "export":
+        parser.error("--format and --output only work with --export")
+    if args.output is not None and args.format == "setup-qr":
+        parser.error("--output only works with --format uri")
+
+    # names the command handlers expect
+    args.action = action
+    args.func = ACTIONS[action][1]
+    args.names = args.remove_backups or []
+    args.name = args.restore
+    return args
+
+
+def main(argv=None):
+    argv = list(sys.argv[1:] if argv is None else argv)
+
+    if hasattr(os, "geteuid") and os.geteuid() == 0:
+        ui.error(msg.ROOT, msg.ROOT_HINT)
+        return 1
+
+    args = parse(argv)
+    try:
+        return args.func(args, make_context())
+    except Abort as e:
+        ui.error(str(e), *e.hints)
+        return 1
+    except (KeyboardInterrupt, EOFError):
+        print(file=sys.stderr)
+        return 130

timo_otp-1.0.1/src/timo/clipboard.py

@@ -0,0 +1,55 @@
+"""Copy codes to the clipboard and clear them again after a delay.
+
+Clearing runs in a small detached process (this file, run as a script), so
+timo itself exits immediately. The code is passed on stdin rather than the
+command line, where other users could see it with ps. The clipboard is only
+cleared if it still holds the code, so anything copied since is left alone.
+"""
+import os
+import subprocess
+import sys
+import time
+
+DEFAULT_CLEAR_AFTER = 45  # seconds, same default as the `pass` password manager
+CLEAR_AFTER_ENV = "TIMO_CLEAR_AFTER"
+
+
+def copy(text):
+    try:
+        import pyperclip
+        pyperclip.copy(text)
+        return True
+    except Exception:
+        return False
+
+
+def schedule_clear(code, seconds):
+    try:
+        proc = subprocess.Popen(
+            [sys.executable, os.path.abspath(__file__), str(seconds)],
+            stdin=subprocess.PIPE,
+            stdout=subprocess.DEVNULL,
+            stderr=subprocess.DEVNULL,
+            start_new_session=True,  # survives timo exiting and Ctrl-C in the terminal
+            close_fds=True,
+        )
+        proc.stdin.write(code.encode())
+        proc.stdin.close()
+        return True
+    except Exception:
+        return False
+
+
+def clear_if_unchanged(code, seconds, paste, copy, sleep=time.sleep):
+    sleep(seconds)
+    try:
+        if paste() == code:
+            copy("")
+    except Exception:
+        pass
+
+
+if __name__ == "__main__":
+    code = sys.stdin.read()
+    import pyperclip
+    clear_if_unchanged(code, float(sys.argv[1]), pyperclip.paste, pyperclip.copy)