Group 2 of the manager wire-up — two CLI ItemUpdaters:
pass/gopass: the user's own password-store as a rotation source. Reads
line-1=password + key:value metadata via `<bin> show`; updates in place by
piping the full body to `<bin> insert -m -f` (off-argv), preserving metadata
across the password swap. gopass enumerates via `ls --flat`, pass by walking
the store dir; --pass-prefix scopes a subtree.
keychain: macOS internet passwords via the `security` CLI. Pure-exec (no
build tag) so it unit-tests cross-platform via a fake bin; Available() is
false off darwin. Read off-argv (find-internet-password -w); write is
delete+add with -w on argv (CLI limitation, documented like 1password).
Both MOCK-ONLY (fake-binary unit tests + leak checks); recorded as DATA in
BROWSER-ROTATION.md §8. 153 tests green, vet clean.
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
One data-driven csvManager (layout = header + record func) covers
edge/brave (chrome layout), safari, lastpass, dashlane, protonpass,
nordpass, roboform, and read/guide-only enpass — replacing 8 near-identical
files. Export is header-name driven (parseLoginCSV + new aliases); import
stages a per-manager-layout CSV on tmpfs and shreds it, gated by --allow-csv.
Notes now round-trip through Meta. Reimporter exposes per-manager re-import
hints. Column layouts are MOCK-ONLY (unit-validated) on the same LIVE-VM
staging machinery; recorded as DATA in BROWSER-ROTATION.md §8.
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
Proven end-to-end (scan→plan→commit→restore-from-backup) against the real
keepassxc-cli 2.7.6 in the incredigo-sbx sandbox VM. The live run surfaced an
adapter bug the fake CSV masked: KeePassXC's CSV "Group" column is the full path
including the root group name (default root is "Passwords"), but keepassxc-cli
addresses entries relative to root (/GitHub, not /Passwords/GitHub). kpEntryPath
now drops the leading root segment; the unit test that encoded the buggy
/Root/GitHub form is corrected and a nested-group table test added.
Records the proof as data: docs/BROWSER-ROTATION.md promotes keepassxc
MOCK-ONLY -> LIVE-VM (the others stay MOCK-ONLY).
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
Add the secondary-persona path from docs/BROWSER-ROTATION.md: ingest a password
manager / browser store, take a mandatory verified sealed backup, generate fresh
strong passwords, hand the human a ready-to-finish task at the MFA wall, and commit
the new value into the manager only after the site change is confirmed.
- internal/pwgen: crypto/rand generator (rejection sampling, per-class guarantee,
vault-native — never returns plaintext as a Go string).
- internal/pwstore: Manager/ItemUpdater/BulkImporter contracts, secrets-free
RedactIdentity, and five adapters — bitwarden (bw, stdin), keepassxc
(keepassxc-cli, stdin), 1password (op, argv assignment with documented caveat),
chrome/firefox (tmpfs CSV ingest-and-shred). All real code; validation status is
data (MOCK-ONLY against fake binaries/CSVs, recorded in the design doc).
- internal/pwstore/stage.go: age-sealed staged-list (WriteStaged/ReadStaged) +
StagedImporter — the only artifacts crossing the plan->commit gap, never plaintext.
- cmd/incredigo: passwords scan|plan|guide|commit. Backup gate seals + round-trip
verifies before any commit; guide is interactive verify-before-commit; commit is
headless over a sealed stage. Browser CSV writes are gated behind --allow-csv.
Hard rules honored: backup-before-commit, verify-before-commit, no plaintext on
disk (browser CSV is the flag-gated tmpfs+shred exception), MFA always a human
handoff. go vet + -race clean; end-to-end verified against a fake bw.
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
leetcrypt