v0.17.21

Pass-CLI 0.17.21

A secure, cross-platform CLI password and API key manager for developers.

Installation

Homebrew (macOS/Linux)

brew install arimxyer/tap/pass-cli

Scoop (Windows)

scoop bucket add arimxyer https://github.com/arimxyer/scoop-bucket
scoop install pass-cli

Manual Installation

Download the appropriate archive for your platform below, extract it, and add the binary to your PATH.

Changelog

Others

• 8ed8e60: chore(deps): bump github.com/gdamore/tcell/v2 from 2.11.0 to 2.13.8 (#72) (@dependabot[bot])

Verification

All binaries are checksummed and can be verified:

sha256sum -c checksums.txt

Full Changelog

See the full changelog at https://github.com/arimxyer/pass-cli/blob/main/CHANGELOG.md

v0.17.2

What's Changed

Performance

• Skip sync push on read-only commands — get no longer triggers a sync push, eliminating unnecessary file hashing and potential network round-trips on every read
• Skip sync push on read-only TUI sessions — browsing credentials without editing no longer triggers a push on exit

UX

• "Syncing... done" feedback — write commands (add, update, delete) and TUI write sessions now show sync progress on stderr

Internal

• SmartPush returns (bool, error) so callers know if a push occurred without redundant checks
• TUI tracks write operations via AppState.MarkWriteOperation() to distinguish read-only sessions

v0.17.1

Performance: Command-layer sync push

Fixes slow vault operations introduced in v0.17.0 by moving sync push from per-save to once-per-command.

Changes

• save() is now purely local I/O — no network calls
• SyncPush() runs once at command end (CLI) or TUI exit
• 5 TUI operations: ~2.1s blocking → ~540ms total

Benchmarks

Operation	Time	Network calls
save()	28ms	0
SyncPush()	80ms	2 (sync + lsjson)

Includes benchmark tests to validate the performance improvement.

v0.17.0

Smart Sync Rearchitecture

Replaces blind rclone sync with intelligent change detection for faster, safer vault synchronization.

New Features

• Smart Pull/Push: Uses rclone lsjson metadata checks and local SHA-256 hashing to skip unnecessary sync operations
• Conflict detection: Detects when both local and remote vault have changed, preventing data loss
• Vault-layer sync integration: Sync is now built into the vault layer — auto-push after save, pull before unlock
• TUI sync support: Both CLI and TUI automatically sync without manual intervention

Improvements

• .sync-state file tracks last push hash, remote modtime, and size for efficient change detection
• Graceful degradation when offline or rclone is unavailable
• Simplified CLI commands — removed redundant sync helper functions
• --exclude .sync-state prevents sync metadata from being uploaded to remote

v0.16.3

Pass-CLI 0.16.3

A secure, cross-platform CLI password and API key manager for developers.

Installation

Homebrew (macOS/Linux)

brew install arimxyer/tap/pass-cli

Scoop (Windows)

scoop bucket add arimxyer https://github.com/arimxyer/scoop-bucket
scoop install pass-cli

Manual Installation

Download the appropriate archive for your platform below, extract it, and add the binary to your PATH.

Changelog

Bug Fixes

• 4023da6: fix: TUI now reads vault_path from config like CLI commands (@arimxyer)

Others

• 01b26e7: Revise README description for clarity (@arimxyer)
• b1259f2: Update welcome message in documentation (@arimxyer)
• aeeeff9: chore(deps): bump github.com/olekukonko/tablewriter (#62) (@dependabot[bot])
• 85fe68b: chore(deps): bump golang.org/x/crypto from 0.46.0 to 0.47.0 (#64) (@dependabot[bot])
• 422baf9: chore(deps): bump golang.org/x/term from 0.38.0 to 0.39.0 (#60) (@dependabot[bot])

Verification

All binaries are checksummed and can be verified:

sha256sum -c checksums.txt

Full Changelog

See the full changelog at https://github.com/arimxyer/pass-cli/blob/main/CHANGELOG.md

v0.16.2

Bug Fixes

• fix: Load config from --config flag before vault path resolution (#68)

  • The --config flag was not being respected because config loading happened before flag parsing
  • Users can now specify vault_path in a custom config file without needing a vault at the default location
  • Fixes #65

• fix: Use fmt.Fprintf instead of WriteString(fmt.Sprintf)

  • Minor code quality improvement

Other Changes

• Added issue management workflow and templates
• Updated project documentation

v0.16.1

What's New

Added

• TUI TOTP Visibility Toggle: View TOTP codes directly in the detail panel
  • Press T (Shift+t) to toggle TOTP code visibility
  • Displays 6-digit code with remaining seconds countdown
  • Press t to copy code to clipboard (unchanged)
  • Updated help modal with new shortcut

Display Examples

When hidden:

TOTP:       GitHub  ('T' to reveal, 't' to copy)

When visible:

TOTP:       GitHub  [123456]  (25s remaining, 'T' to hide, 't' to copy)

---

Full Changelog: v0.16.0...v0.16.1

v0.16.0

What's New

Sync Enable Command (ARI-55)

New pass-cli sync enable command to add cloud sync to existing vaults:

• Interactive remote path configuration
• Validates rclone installation and remote connectivity
• Detects existing files on remote with --force option to overwrite
• Performs initial push after configuration

Sync Health Check (ARI-53)

pass-cli doctor now reports sync status:

• Checks rclone installation and version
• Validates remote configuration
• Reports sync enabled/disabled state

Connect to Synced Vault (ARI-54)

pass-cli init now offers option to connect to existing synced vault:

• Downloads vault from remote during initialization
• Validates downloaded vault with master password
• Configures sync automatically after successful connection

Audit MachineID (ARI-50)

Audit log entries now include MachineID field (hostname):

• Enables tracking vault access across synced devices
• Included in HMAC signature for tamper detection

Other Changes

• Init Flow: Now prompts to create new vault or connect to existing synced vault
• Config Management: saveSyncConfig uses proper YAML marshaling
• Fixed: Clipboard test reliability for parallel execution
• Fixed: Keychain backend detection for Linux Secret Service variants

Installation

Homebrew (macOS/Linux):

brew upgrade pass-cli

Scoop (Windows):

scoop update pass-cli

Full Changelog: v0.15.0...v0.16.0

v0.15.0

Pass-CLI 0.15.0

A secure, cross-platform CLI password and API key manager for developers.

Installation

Homebrew (macOS/Linux)

brew install arimxyer/tap/pass-cli

Scoop (Windows)

scoop bucket add arimxyer https://github.com/arimxyer/scoop-bucket
scoop install pass-cli

Manual Installation

Download the appropriate archive for your platform below, extract it, and add the binary to your PATH.

Changelog

Features

• d258c6a: feat: Add rclone sync integration and portable audit key (@arimxyer)

Bug Fixes

• 90ec215: fix: Address lint errors in sync tests (@arimxyer)

Verification

All binaries are checksummed and can be verified:

sha256sum -c checksums.txt

Full Changelog

See the full changelog at https://github.com/arimxyer/pass-cli/blob/main/CHANGELOG.md

v0.14.1

Pass-CLI 0.14.1

A secure, cross-platform CLI password and API key manager for developers.

Installation

Homebrew (macOS/Linux)

brew install arimxyer/tap/pass-cli

Scoop (Windows)

scoop bucket add arimxyer https://github.com/arimxyer/scoop-bucket
scoop install pass-cli

Manual Installation

Download the appropriate archive for your platform below, extract it, and add the binary to your PATH.

Changelog

Bug Fixes

• 4daf252: fix: Deep copy password bytes in GetCredential to prevent vault corruption (@arimxyer)

Verification

All binaries are checksummed and can be verified:

sha256sum -c checksums.txt

Full Changelog

See the full changelog at https://github.com/arimxyer/pass-cli/blob/main/CHANGELOG.md