Metadata-Version: 2.4
Name: lockedpass-cli
Version: 0.1.2
Summary: Official CLI for LockedPass — zero-knowledge password manager
Author-email: Nextcoders <hello@lockedpass.com>
License-Expression: LicenseRef-Proprietary
Project-URL: Homepage, https://lockedpass.com
Project-URL: Documentation, https://account.lockedpass.com/api-docs
Keywords: password,manager,cli,zero-knowledge,vault,encryption
Classifier: Development Status :: 4 - Beta
Classifier: Environment :: Console
Classifier: Intended Audience :: Developers
Classifier: Intended Audience :: End Users/Desktop
Classifier: Programming Language :: Python :: 3
Classifier: Programming Language :: Python :: 3.11
Classifier: Programming Language :: Python :: 3.12
Classifier: Topic :: Security :: Cryptography
Classifier: Topic :: Utilities
Requires-Python: >=3.11
Description-Content-Type: text/markdown
License-File: LICENSE
Requires-Dist: click>=8.0
Requires-Dist: httpx>=0.28
Requires-Dist: pynacl>=1.5
Requires-Dist: argon2-cffi>=23.0
Requires-Dist: cryptography>=41.0
Requires-Dist: pyperclip>=1.8
Dynamic: license-file

# LockedPass CLI

Official command-line interface for [LockedPass](https://lockedpass.com) — a zero-knowledge password manager for teams and AI agents.

All encryption and decryption happens **locally on your machine**. The server never sees your master password, private key, or any plaintext credential data.

## Requirements

- Python 3.11+
- A LockedPass account (Pro plan or higher)
- An active CLI token generated from **Settings → API & CLI**

## Install

```bash
pip install lockedpass-cli
```

## Quick start

```bash
lp login you@example.com
# Master password: ••••••••  (prompted once, then cached)

lp vault list
lp ls
lp get "GitHub"
lp get "GitHub" --field password
```

## Commands

| Command | Description |
|---|---|
| `lp login <email>` | Authenticate — master password required once |
| `lp lock` | Wipe cached keys (re-prompt on next use) |
| `lp unlock` | Re-cache keys from master password after lock |
| `lp vault list` | List all vaults |
| `lp ls` | List credentials in default vault |
| `lp get <name>` | Show a credential |
| `lp get <name> --field password` | Print a single field (scriptable) |
| `lp add` | Create a credential interactively |
| `lp edit <name>` | Edit a credential |
| `lp rm <name>` | Delete a credential |
| `lp otp <name>` | Generate a live TOTP code |
| `lp generate` | Generate a random password |
| `lp copy <name>` | Copy password to clipboard (clears in 30s) |
| `lp status` | Show session status |
| `lp logout` | Clear saved session |

## Non-interactive / AI agent use

The master password can be passed as an argument or environment variable — useful for automation and AI agents:

```bash
# Argument
lp login lp.aivault@example.com "$LP_AI_PASSWORD"

# Environment variable
LP_MASTER_PASSWORD="$LP_AI_PASSWORD" lp login lp.aivault@example.com
```

After login the session is cached — subsequent commands run without any password.

See [AGENT.md](AGENT.md) for the full AI agent setup guide.

## Security

- **Argon2id** key derivation — only a one-way hash (`auth_verifier`) is sent to the server
- **X25519 + XSalsa20-Poly1305** (NaCl) for vault key encryption
- **XSalsa20-Poly1305** for credential data encryption
- Private key and vault keys never leave your machine in plaintext
- Session cached with a random local key — wiped on `lp lock`

## License

Copyright (c) 2026 Nextcoders LLC. All Rights Reserved. — see [LICENSE](LICENSE)
