# onepasswd

A secure command-line password manager with encryption, GitHub sync, and export capabilities.

## Features

- 🔐 **Encrypted Storage**: AES encryption for all passwords
- 🔍 **Smart Search**: Fuzzy keyword matching
- ☁️ **GitHub Sync**: Sync your password database via GitHub
- 📤 **Export**: Export to Chrome, Apple Keychain, JSON, or plain text
- 🏷️ **Rich Metadata**: Support for titles, URLs, usernames, descriptions, tags, and categories
- 🤖 **AI Migration**: Use OpenAI to intelligently fill missing metadata fields
- 🔄 **Backward Compatible**: Works seamlessly with old simple format

## Installation

```bash
pip install -e .
```

## Quick Start

### Simple Usage (Quick & Easy)

```bash
# Add a password (auto-generated)
onepasswd add github work

# Save an existing password
onepasswd save github work

# Get a password (copies to clipboard)
onepasswd get github

# List passwords
onepasswd list github
```

**That's it!** The simplicity remains - old commands work exactly as before.

### Advanced Usage (Rich Metadata - Optional)

```bash
# Add with full metadata
onepasswd add github work \
  --title "GitHub Account" \
  --url "https://github.com" \
  --username "user@example.com" \
  --description "My main GitHub account" \
  --category work \
  --tags "dev,coding"

# Interactive mode (prompts for all fields)
onepasswd add github work --interactive

# Update existing entry
onepasswd update github --url "https://github.com/login"

# Show detailed information
onepasswd show github --format detail
```

### Migrating Old Data (Batch Add Metadata)

If you have many old entries, use the migration tool to batch-add metadata:

```bash
# Preview what will happen (dry-run)
onepasswd migrate --dry-run

# Auto-migrate with smart inference
onepasswd migrate

# Interactive migration (confirm each entry)
onepasswd migrate --interactive
```

### AI-Powered Migration (NEW!)

Use AI to intelligently fill missing metadata fields:

```bash
# Step 1: Generate AI review file (requires OpenAI API key)
export OPENAI_API_KEY='your-key-here'
onepasswd ai-migrate --context "These are my personal accounts"

# Step 2: Review and edit the generated JSON file
# Edit proposed fields, set approved: false to skip entries

# Step 3: Apply changes
onepasswd ai-migrate-apply review_file.json
```

**Benefits:**
- Automatic inference of title, URL, username, category, tags
- Context-aware suggestions
- Batch processing with review workflow
- Cost-effective (~$0.01 per 100 entries with gpt-4o-mini)

**See:** [AI Migration Guide](docs/AI_MIGRATION.md) for detailed documentation.

## Export to Other Password Managers

### Export to Chrome

```bash
# Export all passwords
onepasswd export chrome -o ~/Desktop/chrome_passwords.csv

# Export specific keyword
onepasswd export chrome github -o passwords.csv
```

Then in Chrome:
1. Go to `chrome://settings/passwords`
2. Click "⋮" → "Import passwords"
3. Select the exported CSV file
4. **Delete the CSV file immediately after import**

### Export to Apple Keychain

```bash
# Export all passwords
onepasswd export apple -o ~/Desktop/apple_keychain.csv

# Export specific keyword
onepasswd export apple work -o passwords.csv
```

Then on macOS:
1. Open "System Settings" → "Passwords"
2. Click "⋮" → "Import Passwords"
3. Select the exported CSV file
4. **Delete the CSV file immediately after import**

### Full Backup (JSON with all metadata)

```bash
onepasswd export json -o backup.json
```

### Plain Text Export

```bash
onepasswd export text -o passwords.txt
```

### Smart Inference

Even if your old data only has simple keywords, export will auto-infer:

```bash
# Old data: entries = ['github', 'work']
# Export automatically infers:
#   - Title: GitHub
#   - URL: https://github.com
```

**Supported services**: github, google, gmail, amazon, aws, facebook, twitter, linkedin, instagram, reddit, netflix, spotify, dropbox, and more.

## GitHub Sync

### Initialize with GitHub

```bash
# Init with GitHub sync (auto-syncs from remote)
onepasswd init \
  --repo "username/repo" \
  --token "github_pat_xxx"
```

This will:
1. Set up local database and configuration
2. Encrypt your GitHub token with your master password
3. Automatically sync from the GitHub repository

### Set Up on Another Device

To set up onepasswd on a new device with the same GitHub repository:

```bash
# On your current device, generate the init command
onepasswd init-command

# Or copy it to clipboard
onepasswd init-command --copy
```

This will output a command like:
```bash
onepasswd init --repo username/repo --encrypted-token <encrypted_token>
```

Copy and run this command on your new device. You'll enter your master password, and it will automatically sync all your passwords from GitHub.

### Manual Sync

```bash
onepasswd sync
```

## Data Format

### Legacy Format (v1)
```json
{
  "hash": {
    "entries": ["github", "work"],
    "passwd": "encrypted_password",
    "time": "1234567890.123"
  }
}
```

### New Format (v2 - Auto-upgraded)
```json
{
  "hash": {
    "entries": ["github", "work"],
    "passwd": "encrypted_password",
    "time": "1234567890.123",
    "version": 2,
    "title": "GitHub Account",
    "url": "https://github.com",
    "username": "user@example.com",
    "description": "My main GitHub account",
    "category": "work",
    "tags": ["dev", "coding"],
    "created_time": "1234567890.123",
    "modified_time": "1234567890.123"
  }
}
```

**Note**: Old data is automatically compatible. Optional fields are only saved when provided.

## Commands

| Command | Description |
|---------|-------------|
| `init` | Initialize configuration and database |
| `sync` | Sync with GitHub repository |
| `add` | Add new password (auto-generated) |
| `save` | Save existing password |
| `get` | Retrieve password (copies to clipboard) |
| `list` | List/search passwords with fuzzy matching |
| `show` | Show detailed entry information |
| `update` | Update entry fields (title, url, username, etc.) |
| `del` | Delete password |
| `export` | Export to Chrome/Apple/JSON/Text formats |
| `migrate` | Batch migrate old entries to v2 format |
| `enc` | Encrypt arbitrary text |
| `dec` | Decrypt ciphertext |
| `web` | Start web interface |

## Options

### Global Options
- `-c, --config PATH`: Config file path (default: `~/.onepasswd/onepasswd.json`)
- `-d, --debug LEVEL`: Log level (default: INFO)
- `-p, --print_passwd`: Print password instead of copying to clipboard

### Add/Save Options
- `--title TEXT`: Display title
- `--url TEXT`: Website URL
- `--username TEXT`: Username or email
- `--description TEXT`: Notes or description
- `--category TEXT`: Category/folder
- `--tags TEXT`: Comma-separated tags
- `-i, --interactive`: Interactive mode with prompts

### Export Formats
- `chrome`: Chrome CSV format
- `apple`: Apple Keychain CSV format
- `json`: JSON with all metadata
- `text`: Human-readable plain text

## Security

- All passwords are encrypted with AES using your master password
- Master password is never stored anywhere
- Export files contain **unencrypted plaintext passwords** - handle with extreme care!
- GitHub sync encrypts credentials before upload
- Use strong master passwords (12+ characters recommended)

### Important Security Notes

⚠️ **Export files contain plaintext passwords!**
- Import to target platform immediately after export
- Delete CSV/text files after successful import
- Never send export files via email or store in cloud drives
- Keep your master password secure and unique

⚠️ **GitHub repository must be private!**
- Synced databases are encrypted but metadata is visible
- Never use public repositories for password storage

## Migration from Old Version

No action needed! Your old data works seamlessly:

✅ **Backward Compatible**
- Old entries remain fully accessible
- Simple commands like `onepasswd add github` still work
- New metadata fields are completely optional
- Data auto-upgrades to v2 format when you add/update

✅ **Smart Migration**
- Use `onepasswd migrate` to batch-add metadata to old entries
- Export automatically infers URLs and titles from keywords
- No manual work required for basic exports

### Common Questions

**Q: Do I need to update my old passwords?**
A: No! Old entries work perfectly. Metadata is optional.

**Q: What if I export entries without URLs?**
A: The system auto-infers URLs from keywords (e.g., "github" → "https://github.com").

**Q: Will sync break with mixed v1/v2 data?**
A: No. Both formats sync correctly and coexist seamlessly.

## Examples

### Complete Workflow

```bash
# Initialize
onepasswd init --repo "myuser/passwords" --token "ghp_xxx"

# Add passwords with metadata
onepasswd add github personal \
  --title "GitHub Personal" \
  --url "https://github.com" \
  --username "myuser@gmail.com" \
  --category personal

onepasswd add aws work \
  --title "AWS Console" \
  --url "https://console.aws.amazon.com" \
  --username "admin@company.com" \
  --category work

# Search and retrieve
onepasswd list work
onepasswd get aws work

# Update information
onepasswd update aws --description "Production account"

# Export for migration
onepasswd export chrome -o chrome_import.csv

# Sync to GitHub
onepasswd sync
```

## Web Interface (Optional)

```bash
# Install Flask
pip install flask

# Start web server
onepasswd web --host 0.0.0.0 --port 10066
```

## License

MIT

## Contributing

Pull requests welcome! Please maintain backward compatibility.
