Repository navigation
release: 5.9.0 — TOTP→QR export, dedicated importers, on-device 2FA audit - #141
Merged
Merged
Conversation
…udit (roadmap 3/9) Three high-priority enhancements from the audit backlog, in one release. No vault format change. - Export a stored TOTP as an otpauth:// QR (roadmap 9): `spm authenticator-qr <id>` and a Dashboard "Show QR" reveal, gated like the secret reveal. The QR round-trips through SPM's own otpauth parser. - Dedicated importers for LastPass, Chrome/Edge and 1Password CSV exports (roadmap 3): import-only, with autodetection when picked as plain CSV; TOTP, folders/tags and secure notes preserved. Field mapping lives in the shared core so the CLI and Dashboard agree. - On-device 2FA-availability audit (roadmap 9 companion): flags password records for a 2FA-supporting service that have no matching authenticator. `spm security --twofa` and a Dashboard action; nothing leaves the device. Tests: core-test +4 (195 passing); regression gains ENH-9/5/3 blocks. Locale parity holds at 585 keys across 12 languages. Signed-off-by: sansyourways <sansyourways@duck.com> Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01FL4yeQE2QLfThZ9vjAaqZd
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Three high-priority enhancements from the audit backlog, shipped in one release. No vault format change (format 6); existing vaults are untouched.
otpauth://QR (roadmap 9).spm authenticator-qr <id>prints a scannable QR and the URI; the Dashboard authenticator view gains a Show QR reveal. The QR encodes the raw secret, so it is revealed on demand, served only to the unlocked session (/authenticator-otpauth-qr), and never rendered up front. It round-trips through SPM's ownotpauth://parser.spm security --twofaon the CLI and a Check for missing 2FA action on the Dashboard. On-device against a bundled list (extendable viaSPM_TWOFA_DOMAINS); nothing leaves the device.Tests
tests/core-test.py: 195 passing (+4 — otpauth round-trip,authenticator_otpauth, 2FA-gap findings, three-importer mapping/detection).tests/regression.sh: new ENH-9, ENH-5 and ENH-3 blocks — all green in the full suite (with the argon2 backend on PATH).build.sh --check,bash -n,shellcheck -x -S warning,py_compile, locale parity (585 keys × 12 languages).Release mechanics
src/spm.sh.inand the 3 browser-extension manifests;spm.shrebuilt.[5.9.0],docs/releases/5.9.0.md, FULL_DOCUMENTATION current-release marker + importer/security sections.🤖 Generated with Claude Code
https://claude.ai/code/session_01FL4yeQE2QLfThZ9vjAaqZd